sonar-integrate

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads installation scripts and tools from the official SonarSource GitHub repository. These include install.sh for macOS/Linux and install.ps1 for Windows, which are standard delivery methods for this vendor's CLI.
  • [COMMAND_EXECUTION]: The skill executes several local commands to manage the SonarQube integration, such as sonar --version, sonar update, sonar auth status, and various sonar integrate [agent] commands. It also checks for the presence of container runtimes using docker ps, podman ps, or nerdctl ps.
  • [REMOTE_CODE_EXECUTION]: The skill provides instructions to download and execute shell scripts directly from GitHub (e.g., curl ... | bash or irm ... | iex). While this is a high-privilege operation, it targets the official SonarSource repository and requires explicit user confirmation before execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 02:07 PM