skills.rest
catatafishen
catatafishenCOMMUNITY
Explore all skills by this author →
GitHub

sonarqube

Analyze SonarCloud quality gate failures and resolve security, reliability, and maintainability findings.

68|16|Updated Feb 28, 2026
Search Tags:#quality gate#coverage#duplication#hotspots#sonarqube#sonarcloud#security findings
One-click install
npx skills add https://github.com/catatafishen/agentbridge --skill sonarqube-catatafishen
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sonarqube
Source: https://github.com/catatafishen/agentbridge/tree/main/.agents/skills/sonarqube
Command: npx skills add https://github.com/catatafishen/agentbridge --skill sonarqube-catatafishen

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps teams diagnose and resolve SonarCloud or SonarQube quality gate failures by turning security, reliability, and maintainability findings into concrete remediation steps.

Core Features & Use Cases

  • Quality gate status triage: Quickly determine whether a project/PR is passing and which conditions are failing.
  • Find-and-fix security & reliability issues: Enumerate open vulnerabilities, bugs, hotspots, and code smells, then drive decisions to SAFE/FIXED/WONTFIX.
  • Duplication and coverage improvement: Identify top duplication offenders and worst coverage gaps to guide targeted refactors and tests.
  • Use Case: When a PR is blocked by “quality gate failed,” use this Skill to list the highest-severity issues and hotspots, review the risky lines, fix what’s actionable, and document legitimate decisions so the gate moves to grade “A.”

Quick Start

Run the SonarQube scripts to fetch the current quality gate status, then list open bugs, vulnerabilities, hotspots, duplication, and coverage so you can fix the root causes that block the gate.

Frequently Asked Questions about sonarqube

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fix SonarCloud quality gate failures on a pull request?▼

To fix SonarCloud quality gate failures, enumerate open vulnerabilities, hotspots, and code smells using authenticated SonarCloud API calls, then resolve the actionable findings or transition issues to wontfix or falsepositive to unblock the pull request.

What is a SonarCloud security hotspot and how do I review it?▼

A SonarCloud security hotspot is security-sensitive code requiring manual review. You can accept the hotspot by marking it as SAFE, FIXED, or ACKNOWLEDGED via the SonarCloud API to clear it from the quality gate review queue.

How do I improve code coverage and duplication blockers in SonarQube?▼

Improve SonarQube coverage and duplication blockers by identifying the worst coverage gaps and top duplication offenders, then applying targeted refactors and writing tests for the specific code blocks flagged by the quality gate conditions.

Do I need a SONAR_TOKEN to check SonarCloud quality gate status?▼

Yes, you need a SONAR_TOKEN to authenticate SonarCloud API calls, which are required to fetch the current quality gate status, enumerate findings, and drive issue transitions or hotspot resolutions.

Can I mark a SonarQube vulnerability as a false positive through automation?▼

Yes, you can automate marking a SonarQube vulnerability as a false positive by driving issue transitions via authenticated SonarCloud API calls, moving the issue state to falsepositive or wontfix to resolve the finding.

Related Skills

Explore More Software Engineering Skills→
agentcultureagentculture
112

sonarclaude

Fetch SonarCloud quality gate status, issues, metrics, and security hotspots.

Official
Intermediate
arcasilesgrouparcasilesgroup
54

ai-quality

Assess code quality metrics, Sonar gates, reviews, and documentation audits.

Official
Advanced
levkisslevkiss

github

Manage GitHub repositories via GitHub CLI for commits, branches, pull requests, issues, releases, and Pages deployment.

Community
Advanced
BagelHoleBagelHole
46

sast-scanning

Performs static security testing on source code using Semgrep, CodeQL, and SonarQube.

Community
Intermediate