How do I install the Sonarqube Scan skill?

Run npx skillmds add majiayu000/sonarqube-scan in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Sonarqube Scan safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Sonarqube Scan?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Sonarqube Scan free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Sonarqube Scan?

majiayu000 (@majiayu000) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Sonarqube Scan by majiayu000 — Agent Skill

Name: Sonarqube Scan
Rating: 4.666666666666667 (3 reviews)
Author: majiayu000

Sonarqube Scan

Run SonarQube/SonarCloud static code analysis to check code quality, detect security vulnerabilities, code smells, and bugs. Use when the user mentions SonarQube, code quality analysis, security scanning, static analysis, or wants to check for vulnerabilities.

majiayu000 886f4d4 2 files · 3.1 KB Updated Sep 9, 2026 567 repo stars

File contents

SonarQube Code Analysis

This skill runs SonarQube/SonarCloud scans on your Python web application to analyze code quality, detect security vulnerabilities, and identify code smells.

When to Use This Skill

Use this skill when you need to:

Run a SonarQube or SonarCloud scan
Check code quality metrics
Find security vulnerabilities
Detect code smells and bugs
Generate static analysis reports
Review code coverage and technical debt

Prerequisites

Before running a scan, ensure:

Python and pip are installed
Project is configured with SonarQube/SonarCloud credentials
Internet connection is available for uploading results

How to Run a Scan

Windows (PowerShell)

Run the PowerShell script:

powershell.exe -ExecutionPolicy Bypass -File .claude/skills/sonarqube/scripts/run_sonar_scan.ps1

Linux/Mac (Bash)

Run the bash script:

bash .claude/skills/sonarqube/scripts/run_sonar_scan.sh

What the Scan Does

Installs pysonar - Automatically installs the SonarQube scanner for Python
Runs analysis - Scans all Python files in the project
Uploads results - Sends results to SonarCloud for analysis
Generates report - Creates a detailed quality report with:
- Code quality metrics
- Security vulnerabilities
- Code smells
- Bugs and issues
- Technical debt
- Code coverage

Understanding Results

After the scan completes:

Visit your SonarCloud dashboard to view results
Check the console output for immediate feedback
Look for critical issues flagged during the scan

For detailed configuration options, see REFERENCE.md.

Troubleshooting

Issue: pysonar installation fails

Check your Python and pip installation
Ensure you have internet connectivity
Try manually installing: pip install pysonar

Issue: Authentication error

Verify your SonarQube token is valid
Check project key and organization are correct
See REFERENCE.md for credential configuration

Issue: Scan timeout

Large projects may take several minutes
Check network connectivity
Review SonarCloud service status

Next Steps After Scanning

Review the SonarCloud dashboard
Address critical security issues first
Fix bugs and code smells
Monitor code quality trends over time
Integrate into CI/CD pipeline for automated scanning

---name: sonarqube-scandescription: Run SonarQube/SonarCloud static code analysis to check code quality, detect security vulnerabilities, code smells, and bugs. Use when the user mentions SonarQube, code quality analysis, security scanning, static analysis, or wants to check for vulnerabilities.--- # SonarQube Code Analysis This skill runs SonarQube/SonarCloud scans on your Python web application to analyze code quality, detect security vulnerabilities, and identify code smells. ## When to Use This Skill Use this skill when you need to: - Run a SonarQube or SonarCloud scan - Check code quality metrics - Find security vulnerabilities - Detect code smells and bugs - Generate static analysis reports - Review code coverage and technical debt ## Prerequisites Before running a scan, ensure: 1. Python and pip are installed 2. Project is configured with SonarQube/SonarCloud credentials 3. Internet connection is available for uploading results ## How to Run a Scan ### Windows (PowerShell) Run the PowerShell script: ```bash powershell.exe -ExecutionPolicy Bypass -File .claude/skills/sonarqube/scripts/run_sonar_scan.ps1 ``` ### Linux/Mac (Bash) Run the bash script: ```bash bash .claude/skills/sonarqube/scripts/run_sonar_scan.sh ``` ## What the Scan Does 1. **Installs pysonar** - Automatically installs the SonarQube scanner for Python 2. **Runs analysis** - Scans all Python files in the project 3. **Uploads results** - Sends results to SonarCloud for analysis 4. **Generates report** - Creates a detailed quality report with: - Code quality metrics - Security vulnerabilities - Code smells - Bugs and issues - Technical debt - Code coverage ## Understanding Results After the scan completes: - Visit your SonarCloud dashboard to view results - Check the console output for immediate feedback - Look for critical issues flagged during the scan For detailed configuration options, see [REFERENCE.md](REFERENCE.md). ## Troubleshooting **Issue: pysonar installation fails** - Check your Python and pip installation - Ensure you have internet connectivity - Try manually installing: `pip install pysonar` **Issue: Authentication error** - Verify your SonarQube token is valid - Check project key and organization are correct - See REFERENCE.md for credential configuration **Issue: Scan timeout** - Large projects may take several minutes - Check network connectivity - Review SonarCloud service status ## Next Steps After Scanning 1. Review the SonarCloud dashboard 2. Address critical security issues first 3. Fix bugs and code smells 4. Monitor code quality trends over time 5. Integrate into CI/CD pipeline for automated scanning

Frequently asked questions