Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add seed-forge/harness-ai-kit --skill infra-sonarqube-opsgit clone --depth 1 https://github.com/seed-forge/harness-ai-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/seed-forge/harness-ai-kit/infra-sonarqube-ops)<a href="https://agentmods.dev/skills/seed-forge/harness-ai-kit/infra-sonarqube-ops"><img src="https://agentmods.dev/badge/skills/seed-forge/harness-ai-kit/infra-sonarqube-ops/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/seed-forge/harness-ai-kit/infra-sonarqube-ops"><img src="https://agentmods.dev/badge/skills/seed-forge/harness-ai-kit/infra-sonarqube-ops.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 72 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 72 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00080 | $0.01919 |
| Opus 5 | $0.00040 | $0.00959 |
| Sonnet 5 | $0.00016 | $0.00384 |
| Haiku 4.5 | $0.00008 | $0.00192 |
Grade A, and why
infra-sonarqube-ops scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 210 lines — stays where its author put it; the contents beside it link to each section on GitHub.
infra-sonarqube-ops
SonarQube Community Edition 代码质量平台的 day-2 运维操作手册。覆盖健康检查、项目管理、质量门禁配置与查询、扫描任务触发与结果解读、Token 生命周期管理。
平台信息
| 项 | 值 |
|---|---|
| 主机 | () |
| 版本 | 10.7.0 Community Edition |
| 域名 | sonarqube.{base_domain} |
| 端口 | 19000 |
| 直连 URL | http://sonarqube.{base_domain}:19000 |
| 镜像 | sonarqube:10.7.0-community |
| 部署路径 | 1panel/apps/sonarqube/sonarqube/ |
| 数据存储 | data→/opt/sonarqube/data, extensions→/opt/sonarqube/extensions, logs→/opt/sonarqube/logs |
用途
- 平台健康检查与探活
- 项目 CRUD 管理
- 质量门禁列表、详情、项目状态检查
- 扫描任务触发与状态查询
- 项目指标（Bugs/Vulnerabilities/Coverage 等）查看
- 用户 Token 生成/列表/撤销
输入
- 项目 Key（project key）
- Token 名称
- 环境变量
SONARQUBE_URL+SONARQUBE_TOKEN
输出
- 健康检查报告（版本、状态）
- 项目列表/详情
- 质量门禁状态（PASSED/ERROR + 条件明细）
- 扫描任务状态（PENDING/IN_PROGRESS/SUCCESS/FAILED）
- 项目指标摘要
工作流
1. 探活
# 快速健康检查
sonarqubectl health
# 预期: ✅ SonarQube 10.7.0.96327 — status: UP
# 带 JSON 输出
sonarqubectl --json health
2. 项目管理
# 列出所有项目
sonarqubectl project list
# 搜索项目
sonarqubectl project list -q "my-app"
# 查看项目详情
sonarqubectl project get my-project-key
# 创建项目
sonarqubectl project create my-new-project --name "My New Project"
# 删除项目（需确认）
sonarqubectl project delete my-old-project
3. 质量门禁
# 列出所有质量门禁
sonarqubectl qualitygate list
# 查看门禁详情（含条件列表）
sonarqubectl qualitygate get 1
# 检查项目的门禁状态
sonarqubectl qualitygate check my-project-key
# 预期输出:
# ✅ Quality Gate: OK
# new_reliability_rating: A (<= A) → OK
# new_security_rating: A (<= A) → OK
4. 扫描任务
# 查看最近扫描状态
sonarqubectl scan status my-project-key
sonarqubectl scan status my-project-key -n 10 # 最近 10 条
# 触发扫描提示（实际扫描需要 sonar-scanner）
sonarqubectl scan trigger my-project-key
5. Token 管理
# 列出当前用户 Token
sonarqubectl token list
# 生成新 Token（输出仅显示一次）
sonarqubectl token create ci-token
# ⚠️ Save this token — it won't be shown again.
# 撤销 Token（需确认）
sonarqubectl token revoke old-token
6. Jenkins 集成（L3）
Jenkins Shared Library 的 sonarScan.groovy 实现完整的 L3 集成：
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 210 lines · 80 tokens per session scan A 20315589f1c3
infra-sonarqube-ops is a skill published in the GitHub repository seed-forge/harness-ai-kit (22 stars, last pushed 10d ago), licensed Apache-2.0. It adds 80 tokens to every session and 1,919 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
refactor
Guides a refactor, cleanup, or restructure with the right decomposition. Use when the user asks to refactor, simplify, extract, or modernize code.
pre-publish-review
Nuclear-grade 12-agent pre-publish release gate. Runs /get-unpublished-changes to detect all changes since last npm release, spawns up to 10 ultrabrain agents for deep per-change analysis, invokes /review-work (orchestrator manual QA plus one gate reviewer) for holistic review, and 1 oracle for overall release…
work-with-pr
Full PR lifecycle in a fresh task-owned git worktree: implement via the ulw-loop skill with mandatory evidence-bound manual QA → reviewer-readable English PR → verification loop (CI + Cubic, where Cubic is skipped only when its quota is exhausted) → merge by default → worktree cleanup. Decomposes one task into the…
remove-ai-slops
Removes AI-generated code smells from branch changes or an explicit file list behind regression tests. Use when the user asks to clean up, deslop, or remove AI-slop patterns from recent changes.
review-work
Post-implementation gate review: run manual QA on the real surface yourself, then launch ONE gate reviewer (never a panel) to audit goal, constraints, code quality, security, missed context, and QA evidence. Use before a PR handoff or when the user explicitly asks to review completed work.
tech-debt-audit
Thorough, file-cited technical debt audit across 9 dimensions using AST-grep (tree-sitter), grep, LSP, and language-native tooling. Produces TECHDEBTAUDIT.md with severity, effort estimates, and prioritized fixes. Use when asked for codebase health check, tech debt audit, architecture review, code quality assessment…