sonar-list-projects
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
sonar list projectscommand. It includes a security check in Step 2 that validates user-provided arguments against a strict regex (^[a-zA-Z0-9_\-\.\ ]+$), effectively preventing command injection attacks. - [SAFE]: The skill utilizes the
sonarqube-cli, which is the official tool provided by the vendor, SonarSource. The workflow for setting up this dependency via a separate integration skill is a standard and secure practice for environment configuration.
Audit Metadata