sonarqube-scan SKILL.md skillA
sonarqube-scan from bislink360/styled-markdown is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add bislink360/styled-markdown/sonarqube-scan@git:20260929.1fabbecPins git:20260929.1fabbec in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- bislink360/styled-markdown
- Path
.claude/skills/sonarqube-scan/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260929.1fabbec, committed Sep 29, 2026
- Size
- 6,942 bytes
- Repository stars
- 3
- License
- MIT
Run static code analysis on the Styled Markdown repository with a local SonarQube server in Docker Compose, and gate releases on its results — bugs, vulnerabilities, security hotspots, code smells, duplication, maintainability and coverage. Use this skill before every release (on the release branch, before tagging and before marking the tracking PR ready), before opening a feature PR, and whenever the user asks for a code-quality, static-analysis, SonarQube/Sonar, lint, "code smells…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# SonarQube gate GitHub CI runs typecheck, tests and the compatibility check, but **no static analysis**. This skill fills that gap locally: a SonarQube Community server runs in Docker Compose on the maintainer's machine, analyses the current checkout, and blocks the release if it finds new problems. Nothing leaves the machine, and no CI secrets are needed. | File | Purpose | |---|---| | `docker-compose.yml` | SonarQube Community + Postgres (UI on `127.0.0.1:9000`), and a `scan` profile with `sonar-scanner-cli` | | `scripts/sonar-scan.mjs` | Starts the server, bootstraps credentials, runs coverage + scanner, applies the gate, writes the report | | `baseline.json` | Existing findings a maintainer accepted as known debt. Reported, but not blocking | | `/sonar-project.properties` (repo root) | What is analysed: hand-written sources only, never `dist/`, bundled `smd.cjs` or `media/vendor/` | ## When to run it | Moment | Command | Must pass? | |---|---|---| | Before opening a feature PR into `release/vX.Y.Z` | `sonar-scan.mjs` | Yes: fix or justify new findings in the PR | …
Read the whole file at its exact version.
How to install
mdr add bislink360/styled-markdown/sonarqube-scan@sha256:7eaaac505b8c60efThe line at the top of this page pins the label git:20260929.1fabbec, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_bfagrgeerfxgfdbh)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Sep 29, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (6942 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
bislink360/styled-markdown · 3 stars · license MIT · pushed 2026-10-31 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_bfagrgeerfxgfdbh GET https://markdownregistry.com/api/v1/resolve?ref=bislink360/styled-markdown/sonarqube-scan GET https://markdownregistry.com/api/v1/blob/7eaaac505b8c60efb9067982e3575207100539ebe147c38b069125d8c336e44a
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.