sonarqube-tactics

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill prompt repeatedly instructs embedding plaintext credentials and tokens directly into commands (e.g., curl -u admin:admin and token strings), which requires the LLM to handle and output secret values verbatim and thus creates a high risk of secret exfiltration.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The list includes attacker-controlled endpoints (https://attacker.com/...) used as webhook/callback targets in the skill — clearly malicious/suspicious (can be used for data exfiltration or to host/serve payloads).

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This is an explicit offensive playbook: it contains step‑by‑step instructions to discover SonarQube instances, steal source code and configuration (including tokens/passwords), create persistent backdoors (generated tokens, malicious webhooks), and manipulate CI gates — clearly malicious and intended for abuse.