Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mushroomTW/MushroomTW-Skills --skill sonarqube-fix-allgit clone --depth 1 https://github.com/mushroomTW/MushroomTW-SkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mushroomtw/mushroomtw-skills/sonarqube-fix-all)<a href="https://agentmods.dev/skills/mushroomtw/mushroomtw-skills/sonarqube-fix-all"><img src="https://agentmods.dev/badge/skills/mushroomtw/mushroomtw-skills/sonarqube-fix-all/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mushroomtw/mushroomtw-skills/sonarqube-fix-all"><img src="https://agentmods.dev/badge/skills/mushroomtw/mushroomtw-skills/sonarqube-fix-all.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00038 | $0.01776 |
| Opus 5 | $0.00019 | $0.00888 |
| Sonnet 5 | $0.00008 | $0.00355 |
| Haiku 4.5 | $0.00004 | $0.00178 |
Grade A, and why
sonarqube-fix-all scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 138 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Fix All SonarQube Issues
Resolve SonarQube findings at the source, verify each batch, and distinguish fixed, suppressed, and left-open results.
This skill runs only when invoked by name.
Constraints
These hold for the entire workflow:
- Target self-hosted SonarQube in Docker, never SonarCloud; do not request an organization key or use SonarCloud setup.
- Query through the configured MCP connection. Scan only with the
SONAR_TOKENsystem environment variable; never request, create, display, modify, print, echo, or log credentials. - Do not change server-side status or propose candidates for approval.
Accepted,False positive,Won't fix, exclusions, and disabled rules require an explicit target (issue keys, or one rule scoped to a named file/module) and the desired status. Vague targets such as "unimportant issues" are invalid: 🛑 STOP reclassification, say why, continue source fixes, and report unsafe/unfixable findings as left-open for the user to reclassify. - Never reset, revert, or discard the user's existing changes. Never push.
- Keep output lean: summaries and relevant excerpts, not full payloads, issue dumps, or raw logs.
1. Detect the project's toolchain
Infer these from repository manifests, lockfiles, scripts, and config; do not assume a language or runner:
| Need | Resolve from |
|---|---|
| Build / compile command | project manifest and its documented scripts |
| Formatter and linter | project config files, or the ecosystem default already in use |
| Test command | test config present in the repo |
| Warning baseline | output of the build command before any change |
| Local suppression syntax | the language's own mechanism (see §6) |
For monorepos, resolve per module and do not mix modules in a batch.
2. Preflight
🛑 STOP — do not edit a single file until all three pass. If any of them fails, report which one and wait for the user:
- Working tree is clean, or the user confirms the existing changes should be carried along.
- The project builds green before any changes. Never start batch-fixing on a project that does not build — the build is the only verification signal available in later steps.
- Work happens on a dedicated branch, created if needed.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +3 lines · -77 tokens per session 08be90c1161e
- 8d ago Changed · +2 lines 816bbf039fef
- 11d ago First seen · 133 lines · 115 tokens per session scan A e2e4c6c4db0b
sonarqube-fix-all is a skill published in the GitHub repository mushroomTW/MushroomTW-Skills (0 stars, last pushed yesterday), licensed MIT. It adds 38 tokens to every session and 1,776 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
recipe-front-review
Reviews completed frontend implementation for governing-source compliance, scope economy, repository quality, and security, then applies user-approved React corrections.
new-skill
Scaffold a new brooks-lint analysis skill so it passes npm run validate and npm run evals on the first try — generates skills/{name}/SKILL.md (with the mandatory "Do NOT trigger for:" clause and a Process section citing guide step ranges) plus skills/{name}/{name}-guide.md (sequentially numbered steps), then appends…
brooks-sweep
Full-sweep mode: runs a unified analysis across all quality dimensions — code decay, architecture, tech debt, and test quality — then applies fixes directly to the codebase. Safe changes are auto-applied; risky changes are confirmed before execution. Drawing on twelve classic engineering books. Triggers when: user…
brooks-test
Test quality review drawing on twelve classic engineering books — with primary focus on xUnit Test Patterns, The Art of Unit Testing, How Google Tests Software, and Working Effectively with Legacy Code — that diagnoses structural problems in an existing test suite: brittleness, mock abuse, coverage illusions, slow…
dorodango
Polishes working code through successive quality passes in fresh subagents. Use after tests pass when code needs multi-dimension refinement before release.
ring:exploring-codebases
Exploring a codebase across phases: scopes the target, detects architecture, components, and layers, deep-dives each discovered perspective, then synthesizes findings into actionable guidance with file:line evidence. Use to understand how a feature or system works before planning changes, or to orient on an unfamiliar…