The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes multiple shell commands to manage the environment and build lifecycle.
Evidence: docker run is used to start a SonarQube container in references/docker-sonar-validation.md.
Evidence: mvn clean package and mvn sonar:sonar are used for building the plugin and running scans.
Evidence: scripts/verify_sonar_plugin.sh uses curl to interact with the SonarQube API using user-provided hosts and tokens.
[REMOTE_CODE_EXECUTION]: The skill generates Java source code and XML rulesets at runtime and then executes Maven to package them into a JAR file. This involves runtime compilation and the download of dependencies from Maven Central.
Evidence: The Phase 5: Sonar Plugin Packaging in references/workflow-playbook.md describes building the custom plugin module.
[PROMPT_INJECTION]: The skill ingests untrusted specification documents to drive its logic. This is an indirect prompt injection surface where a malicious specification file could attempt to influence the agent's classification or implementation decisions.
Ingestion point: User-provided specification files (SKILL.md).
Capability inventory: Shell execution via docker, mvn, and curl.
Boundary markers: Not explicitly defined for the parsing logic.
Sanitization: Not explicitly mentioned for the spec-to-rule transformation.
[CREDENTIALS_UNSAFE]: The documentation references default credentials (admin:admin) for local SonarQube instances.
Evidence: curl -u "admin:admin" in references/docker-sonar-validation.md. While standard for local setup, this is noted as a credential handling practice.

eliteforge-sonar-pmd-generator