Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/686f6c61/alfred-dev/sonarqubenpx skills add 686f6c61/alfred-dev --skill sonarqubegit clone --depth 1 https://github.com/686f6c61/alfred-devWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/686f6c61/alfred-dev/sonarqube)<a href="https://agentmods.dev/skills/686f6c61/alfred-dev/sonarqube"><img src="https://agentmods.dev/badge/skills/686f6c61/alfred-dev/sonarqube.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00039 | $0.01540 |
| Opus 5 | $0.00019 | $0.00770 |
| Sonnet 5 | $0.00008 | $0.00308 |
| Haiku 4.5 | $0.00004 | $0.00154 |
Grade D, and why
sonarqube scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo systemctl start docker Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsSL https://get.docker.com | sh Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://get.docker.com | sh How it starts
The opening of the file, as written. The whole thing — 176 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Análisis de calidad con SonarQube
Resumen
Este skill levanta una instancia de SonarQube con Docker, ejecuta un análisis del código del proyecto y traduce los resultados en propuestas de mejora accionables. SonarQube detecta bugs, vulnerabilidades, code smells y problemas de cobertura que las herramientas de linting no cubren.
No sustituye al qa-engineer ni al security-officer: complementa su trabajo con una segunda opinión automatizada basada en reglas estáticas probadas en millones de proyectos.
Proceso
Paso 1: preflight de Docker y permisos
Comprobar si Docker está disponible y si el daemon responde:
docker --version
docker info
Interpreta el resultado con estas reglas:
- Si
docker --versionfalla: Docker no está instalado. Explica al usuario que SonarQube lo necesita y que la instalación puede requerir permisos de administrador. - Si
docker --versionfunciona perodocker infofalla: Docker está instalado, pero el daemon no está disponible. Explica al usuario que hay que arrancar Docker Desktop o el servicio del sistema antes de continuar.
No instales Docker, no abras Docker Desktop y no arranques el daemon sin aprobación explícita del usuario. Si la orden viene desde /alfred audit, respeta la decisión tomada en su preflight. Si no existe una autorización previa, pídela ahora y espera respuesta.
Si el usuario autoriza la instalación, instala la última versión estable según la plataforma:
macOS:
brew install --cask docker
open -a Docker
Linux (Ubuntu/Debian):
curl -fsSL https://get.docker.com | sh
sudo systemctl start docker
sudo usermod -aG docker $USER
Windows (PowerShell como administrador):
winget install Docker.DockerDesktop
Si el usuario autoriza arrancar Docker cuando está instalado pero el daemon no responde, usa la estrategia mínima necesaria para la plataforma:
macOS:
open -a Docker
Linux (systemd):
sudo systemctl start docker
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 176 lines · 39 tokens per session scan D f3d8da0f1870
sonarqube is a skill published in the GitHub repository 686f6c61/alfred-dev (119 stars, last pushed 21d ago), licensed MIT. It adds 39 tokens to every session and 1,540 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it D with 3 findings (asks for root, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
release-it
Build production-ready systems with stability patterns: circuit breakers, bulkheads, timeouts, and retry logic. Use when the user mentions "production outage", "circuit breaker", "deployment pipeline", "chaos engineering", "retry storm", "health checks", "my service keeps crashing", "prevent cascading failures", or…
tidewave-integration
Tidewave MCP runtime tools — debugging, smoke testing, live state inspection, SQL queries, hex docs. Use when evaluating code in a running Phoenix app.
debug
Interactive debugging workflow with hypothesis-driven probe loop. Use when: unknown bugs, script errors, silent failures, troubleshooting. Not for: known bugs (use bug-fix), GitHub issue analysis (use issue-analyze), code understanding (use code-explore). Output: debug report with probe journal + root cause + fix.
analyze
Deep-dive codebase analysis that explains how things actually work — business rules, architecture patterns, auth flows, data models, integrations, and performance hotspots. Use whenever the user asks "how does X work", "map the Y flow", "what are the business rules for Z", "trace the auth path", "explore the codebase…
simplify
Wrap-up refactoring — simplify code, eliminate duplication, preserve behavior.
incremental-analysis
Detect existing workspace, diff current sources against high water mark metadata, classify specs as unchanged/stale/orphaned/new, re-analyze only what changed. Activates automatically when /analyze finds an existing workspace.