sonar-list-issues
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
sonarqube-clitool. To ensure safety, it mandates a validation step where all user-provided arguments, such as project keys and branch names, are checked against restrictive alphanumeric regular expressions, preventing arbitrary shell command injection. - [DATA_EXPOSURE]: The skill reads the
sonar-project.propertiesfile within the repository root to automatically resolve the project identifier. This access is scoped to standard project configuration and does not involve sensitive system-level files or credentials. - [EXTERNAL_DOWNLOADS]: Mentions the
sonar-integrateskill for CLI installation and setup. Since the skill is authored by SonarSource, the referenced tooling is considered an official vendor resource.
Audit Metadata