sonar-integrate

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill will, with user confirmation, execute shell/PowerShell commands that fetch and run remote scripts (curl ... | bash and irm ... | iex) from https://raw.githubusercontent.com/SonarSource/sonarqube-cli/refs/heads/master/user-scripts/install.sh and https://raw.githubusercontent.com/SonarSource/sonarqube-cli/refs/heads/master/user-scripts/install.ps1, which executes remote code at runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (low risk: 0.30). The skill repeatedly instructs the agent to execute shell commands on the host (including running remote install scripts like curl|bash and PowerShell iex) and to modify other tools' configurations via "sonar integrate", which does change the machine's state — but it does not request sudo, bypass security mechanisms, or create users, so the risk is moderate-low.