sonar-quality-gate
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes project status and metric data from SonarQube API responses. This creates a surface for indirect injection if the source data were to contain malicious instructions.
- Ingestion points: Results from
mcp__sonarqube__get_project_quality_gate_statusand thesonar apiCLI tool. - Boundary markers: No explicit delimiters or instructions are provided to the agent for handling untrusted content within the API response.
- Capability inventory: Shell execution via
sonarCLI, container diagnostic tools (docker,podman,nerdctl), and local file reads. - Sanitization: No specific filtering or escaping of API-returned metric keys or values is performed before formatting them for the user.
- [COMMAND_EXECUTION]: The skill uses
sonarand container runtime commands (docker,podman,nerdctl) to fetch analysis data and verify the environment status. These commands are scoped to the platform's diagnostic requirements. - [EXTERNAL_DOWNLOADS]: Mentions documentation from
docs.sonarsource.com, which is the official support domain for the vendor's products.
Audit Metadata