Does this skill support filtering results?

While the default script fetches all issues, it can be easily modified to filter by severity levels (e.g., BLOCKER, CRITICAL) or specific issue statuses.

Where can I find the output of the audit?

The audit results are exported to a CSV file in the skill's directory, typically named 'sonarcloud-security-issues' followed by a timestamp.

What are the prerequisites for using this skill?

You need Node.js v18 or higher and a valid SonarCloud API token with read access to the nasa-pds organization.

What is the difference between a vulnerability and a security hotspot in the report?

Vulnerabilities are identified issues that require fixing, while security hotspots highlight security-sensitive code that requires manual review to determine if a vulnerability exists.

Can this skill handle a large number of repositories?

Yes, the skill is designed to handle large result sets by implementing pagination logic and automatic retry mechanisms for API rate limiting.

SonarCloud Security Audit Tool

Name: SonarCloud Security Audit Tool
Author: NASA-PDS

byNASA-PDS

0•

安全与测试

Conducts automated security audits of SonarCloud vulnerabilities and hotspots across NASA PDS repositories and exports detailed reports for triage.

This skill streamlines security workflows by automating the extraction of vulnerabilities and security hotspots from SonarCloud for all repositories within the NASA PDS organization. It handles complex API interactions, including authentication, pagination, and rate limiting, to generate a comprehensive CSV report. By aggregating data like severity levels, rule IDs, and direct links to the source code, it enables security teams and developers to perform efficient bulk triage and maintain a robust security posture across large-scale project portfolios.

主要功能

01Automated discovery and scanning of all repositories within the NASA PDS organization.

02Real-time summary statistics of findings across the entire project landscape.

03Comprehensive CSV export featuring severity, status, file paths, and direct URLs for every issue.

04Robust API handling with built-in support for pagination and 429 rate-limit retries.

050 GitHub stars

06Dual-track reporting for both confirmed vulnerabilities and security hotspots requiring review.

使用场景

01Generating organization-wide security posture reports for stakeholders and compliance.

02Facilitating bulk triage sessions to prioritize critical vulnerabilities across multiple repositories.

03Tracking security debt and identifying recurring code patterns that require global remediation.

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add nasa-pds/pds-agent-skills sonarcloud-security-audit

For use in Claude.ai and ChatGPT

主要功能

01Automated discovery and scanning of all repositories within the NASA PDS organization.

02Real-time summary statistics of findings across the entire project landscape.

03Comprehensive CSV export featuring severity, status, file paths, and direct URLs for every issue.

04Robust API handling with built-in support for pagination and 429 rate-limit retries.

050 GitHub stars

06Dual-track reporting for both confirmed vulnerabilities and security hotspots requiring review.

使用场景

01Generating organization-wide security posture reports for stakeholders and compliance.

02Facilitating bulk triage sessions to prioritize critical vulnerabilities across multiple repositories.

03Tracking security debt and identifying recurring code patterns that require global remediation.