Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add 686f6c61/alfred-dev --skill sonarqubegit clone --depth 1 https://github.com/686f6c61/alfred-devWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/686f6c61/alfred-dev/sonarqube)<a href="https://agentmods.dev/skills/686f6c61/alfred-dev/sonarqube"><img src="https://agentmods.dev/badge/skills/686f6c61/alfred-dev/sonarqube/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/686f6c61/alfred-dev/sonarqube"><img src="https://agentmods.dev/badge/skills/686f6c61/alfred-dev/sonarqube.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00039 | $0.01540 |
| Opus 5.5 | $0.00016 | $0.00616 |
| Sonnet 5.5 | $0.00008 | $0.00308 |
| Haiku 4.5 | $0.00004 | $0.00154 |
Grade D, and why
sonarqube scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo systemctl start docker Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsSL https://get.docker.com | sh Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://get.docker.com | sh How it starts
The opening of the file, as written. The whole thing — 176 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Análisis de calidad con SonarQube
Resumen
Este skill levanta una instancia de SonarQube con Docker, ejecuta un análisis del código del proyecto y traduce los resultados en propuestas de mejora accionables. SonarQube detecta bugs, vulnerabilidades, code smells y problemas de cobertura que las herramientas de linting no cubren.
No sustituye al qa-engineer ni al security-officer: complementa su trabajo con una segunda opinión automatizada basada en reglas estáticas probadas en millones de proyectos.
Proceso
Paso 1: preflight de Docker y permisos
Comprobar si Docker está disponible y si el daemon responde:
docker --version
docker info
Interpreta el resultado con estas reglas:
- Si
docker --versionfalla: Docker no está instalado. Explica al usuario que SonarQube lo necesita y que la instalación puede requerir permisos de administrador. - Si
docker --versionfunciona perodocker infofalla: Docker está instalado, pero el daemon no está disponible. Explica al usuario que hay que arrancar Docker Desktop o el servicio del sistema antes de continuar.
No instales Docker, no abras Docker Desktop y no arranques el daemon sin aprobación explícita del usuario. Si la orden viene desde /alfred audit, respeta la decisión tomada en su preflight. Si no existe una autorización previa, pídela ahora y espera respuesta.
Si el usuario autoriza la instalación, instala la última versión estable según la plataforma:
macOS:
brew install --cask docker
open -a Docker
Linux (Ubuntu/Debian):
curl -fsSL https://get.docker.com | sh
sudo systemctl start docker
sudo usermod -aG docker $USER
Windows (PowerShell como administrador):
winget install Docker.DockerDesktop
Si el usuario autoriza arrancar Docker cuando está instalado pero el daemon no responde, usa la estrategia mínima necesaria para la plataforma:
macOS:
open -a Docker
Linux (systemd):
sudo systemctl start docker
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 176 lines · 39 tokens per session scan D f3d8da0f1870
sonarqube is a skill published in the GitHub repository 686f6c61/alfred-dev (115 stars, last pushed 2mo ago), licensed MIT. It adds 39 tokens to every session and 1,540 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it D with 3 findings (asks for root, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
observability
Production observability workflow for adding logs, metrics, alerts, and other signals that show what software is doing while it runs.
tdd
A test-first development workflow that writes a failing test before the code, then makes it pass and improves the design.
a11y-review
A review of a website or application for accessibility, meaning whether people with disabilities can use it. It covers standards such as WCAG, keyboard controls, screen readers, focus, contrast, and color-based signals.
debugging
Diagnose a failure, fix its root cause and verify the original scenario. Triggers on "debug", "调试".
audit
Project health audit and health check — architecture, performance, tests, dependencies, code quality. Use when assessing overall project health, before releases, or after refactors.
anti-patterns
Catalogue of known SDLC anti-patterns that greatcto agents must actively reject when reviewing architecture, plans, code, or post-mortems. Used by architect (pre-impl), pm (planning), senior-dev (impl), l3-support (post-incident).