sonar-dependency-risks
Search for software composition analysis (SCA) dependency risks in a SonarQube project (project key optional when MCP integration already defines the default project)
Install
With your agent
Install OMGSkills skill "sonarsource/sonarqube-agent-plugins:skills/sonar-dependency-risks" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/SonarSource/sonarqube-agent-plugins /tmp/sonarqube-agent-plugins && ln -s /tmp/sonarqube-agent-plugins/skills/sonar-dependency-risks ~/.claude/skills/sonar-dependency-risksFrom README
SonarQube — Dependency Risks Search for dependency risks (software composition analysis issues) in a SonarQube project, paired with the releases that appear in the analysed project, application, or portfolio. Prerequisites This skill requires SonarQube Advanced Security (available on SonarQube Cloud Enterprise plan, or SonarQube Server 2025.4 Enterprise edition or higher), the SonarQube MCP Server to be configured, and the tool mcpsonarqubesearchdependencyrisks to be available in your session. Before proceeding, verify the tool is accessible. If it is not, try the CLI fallback in Step 3 before giving up — don't invent other CLI commands (e.g. sonar mcp call or sonar dependency-risks do not exist). If the CLI fallback also fails or doesn't apply, narrow down the cause — check whether the sonarqube MCP server is enabled in this agent's configuration.
More from this repo
sonar-analyze
Used to analyze a file for quality and security issues using SonarQube
sonar-coverage
Used to find files with low test coverage and inspect uncovered lines in a SonarQube project (project key optional when...
sonar-duplication
Used to find files with code duplications in a SonarQube project and inspect duplication blocks for a file (project key...