sonarqube — 1 hook

Pinned source listing — machine-checked

What declarations and files are present in this pinned source?

Pinned source declarations and file hashes were listed.

Review

Machine-checked ·

Run UTC
Reviewed
Published
Updated

Observations · Limitations · Evidence

Works with:

Works with Claude Code
Works with Grok Build

What we ran

Git blob acquisition followed by static source inspection.

What we saw

Listed 1 hook declaration. Ran 46 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.

Limits

Scope: acquisition and static inspection. Command results: commands.json.

developer-tools · hooks · Upstream source · Upstream documentation

Pinned source inspection only; no runtime platform was exercised. UTC 2026-10-19T18:07:27Z, tree 36e7f36b5e612382c613691dfaefd8bc567cf3b9955515e85cc63dab2a7b0e6f.

No browser or computer-use tools. Pin this exact version; the stamp does not follow updates.

Full record
name
sonarqube — 1 hook
slug
source-hooks-895c0724ba0156fbd5d3cc2d
type
hooks
category
developer-tools
example
false
evidence state
pinned_source_listing
stamp
Pinned source listing — machine-checked
summary
Pinned source declarations and file hashes were listed.
outcome
Listed 1 hook declaration. Ran 46 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.
rule results
["The retained source tree matches its acquisition manifest.","Declared hook names (listing.json): SessionStart"]
task
What declarations and files are present in this pinned source?
setup
Git blob acquisition followed by static source inspection.
limitations
Scope: acquisition and static inspection. Command results: commands.json.
source url
https://github.com/SonarSource/sonarqube-agent-plugins.git
documentation url
https://github.com/SonarSource/sonarqube-agent-plugins.git
commit
5a9356d957db063e4d2cf87511b44cc1ba88dc99
tree sha256
36e7f36b5e612382c613691dfaefd8bc567cf3b9955515e85cc63dab2a7b0e6f
file sha256
{".agents/plugins/marketplace.json":"a09533cc2d4a5dbed884353591ab8b6d61d3fb583ca797331af45d1c9484484e",".claude-plugin/marketplace.json":"8856b2020a808546e2251001df245c9ec1327078faab8d04e0d6bb716bfa0826",".claude-plugin/plugin.json":"a65858d032e7281e50a197eba2a8d180e066f2aa7264402e04577db6b2d4a71c",".codex-plugin/plugin.json":"7a32f74e35de96a4313d6b900968cfb5079b3666ff7fde439f1dcec7c449a067",".cursor-plugin/marketplace.json":"3985ef713f5159cd69b3fb319326fab3ecf3d9a44e91d26dbe88b15ec5506b06",".cursor-plugin/plugin.json":"d3b768d5ceb52b74dc660a0a342b1565d7ff66f060c548a844f200addf196854",".factory-plugin/marketplace.json":"1da72c735f06b4a7f988496acd5598167a5ed26896dd9b4cb836eaaeb48cde9d",".factory-plugin/plugin.json":"26780fe75f425a4b0e1c05cf60e582d26358c51dd08d16846398acdde1b72b5a",".github/CODEOWNERS":"3ecbd4a4c501695a25651bf18274da43715ed4f7581ef2d903ee96f6eeea5193",".github/plugin/marketplace.json":"8856b2020a808546e2251001df245c9ec1327078faab8d04e0d6bb716bfa0826",".github/plugin/plugin.json":"9cb2627036a4b8f288a6ef5c048cbc06c84c4536ebe5db76a30b8c17d8c88a04",".github/renovate.json":"c049351f0cb07629effa5dcf2334668c4a901633d7d75ffc55f586863a2704ee",".gitignore":"3ceeb56b31ab247687626eb9530979e2d5e1249ee7120fd0018374f6fd0a1515","GEMINI.md":"d391a9a3936197db238a52edfc16e118db137d9b4eb4b89079092999de57a431","LICENSE":"5ed3eff27f4bbbc595e91b06981eb3eee50fc3f7e7ca04c3fdb2c20f03569bd1","README.md":"c5685d7a8b958b20b860ccb2169d70d56efeaf138f305adba6ec687fc0df3df2","SECURITY.md":"ff94ac6750964ab542a0884019962bda31fee27450a356458e188d331fc18411","agents/sonarqube-reviewer.agent.md":"b34a4fe6a1717b180bcd09da293571af6d7b23afa83d8c3244de6b447ea30de8","assets/logo-dark.png":"fda3a22b9fa041ea7630ae6ac263da36a54ab5172d046102cd92693025338cb6","assets/logo.png":"89048de870cebf93c7d7660ff434259da48f029536840d6c3d533678047ad84d","assets/logo.svg":"f229ce40967152b9f6ec6bab2b4989cf65bb3d723c044fd3a9945db58a686028","claude-hooks/hooks.json":"ca69a9b5a1f3f0b5bc07b29490743c66ce69ed022e0717700743cc2084946fdf","droids/sonarqube-reviewer.md":"aa3b99272098d6daeb18602f0a557945fc95d4192435002c4925035486917015","gemini-extension.json":"2c3cf2ab933033957dec14f07bb3e69c9a53bafc907a95aa7819f90e1e8def75","kiro-power/POWER.md":"06756d58b713496afdcb01c9e0b49a6fee09b562fc1aee1c65cf9a17648f718f","kiro-power/mcp.json":"9fc1ce60f5774b42ee805b390a43405536e51401e3e33a19dce204fe6c71497e","mcp.json":"2b3827a30692ba8d188040e90f4d51bf10c0de900ab3889a7fe2fce4ee66ef0d","mcp_config.json":"2b3827a30692ba8d188040e90f4d51bf10c0de900ab3889a7fe2fce4ee66ef0d","plugin.json":"9cb2627036a4b8f288a6ef5c048cbc06c84c4536ebe5db76a30b8c17d8c88a04","rules/sonarqube.md":"39d56e55a066ffaa153e71f777dbaf3995035e933651dd1491007c060ee1336f","scripts/setup.js":"b96ca90e1ee30db9b629224418c9345abe5a56f1496f026dcca321a641bd49d0","skills/sonar-analyze/SKILL.md":"575142711c38ff1d50b2b74c5de9a1be19cb050bd58c0a562716ac2779e0c87b","skills/sonar-coverage/SKILL.md":"cffca8cab282592be0c786566e7ca9828d5fa3d68e658717a9734591a58814a1","skills/sonar-dependency-risks/SKILL.md":"15b26da2d3298f6739d262344eebe9e3a71e6b02d87573003ef4b74ab7f96a96","skills/sonar-duplication/SKILL.md":"a73546e05609daf1d47068e2852590c7ae8527e454443c61dc25ffcc5dec46a3","skills/sonar-fix-issue/SKILL.md":"6b57ea6a2b6348b53dc20c0bbe79e27e4fd8520d67c30f1139d919f285bced74","skills/sonar-integrate/SKILL.md":"7054a0e5282cde06dcd8ba0f7fa944467183aa6f1422b446c2d81a8e5e60ad6d","skills/sonar-list-issues/SKILL.md":"5dfc6cc08df66a4a0ca5f25c1f3b5a3e89266daca5acea33493341fedcd92a9e","skills/sonar-list-projects/SKILL.md":"b13d7d8a62db78098d7a0577cee3952031ce791f496ce348436f5dd9de3685a3","skills/sonar-quality-gate/SKILL.md":"a10642dbea25b0c4fa724581af91bf80e7b84d61f8db470e8ef99bda03e418df","skills/sonar-triage-dependency-risks/SKILL.md":"8d5bb7d03e6edf7771794db781b04d0ba17c8b49519836ddb2b1df98dcd18d47"}
lockfiles
["LOCK.json"]
utc date
2026-10-19T18:07:27Z
source date
2026-10-16
discovered date
2026-10-16
retested date
2026-10-19
reviewed date
2026-10-19
published date
2026-10-19
modified date
2026-10-19
reviewer
Machine-checked
harness version
toolwitness harness at commit 11dde7217ae6f8e4ac4d18a6380b18ba01450122
claude code version
Not applicable: static source inspection (commands.json).
model id
Not applicable: static source inspection (commands.json).
scanner version
Not applicable: static source inspection.
rulepack version
Not applicable: static source inspection.
agents
[]
commands
["Ran 46 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection."]
prompt list
["Not applicable: static source inspection (commands.json)."]
history
["2026-10-19T18:07:27Z: pinned source inspection"]
application
{"applicationCategory":"DeveloperApplication","name":"sonarqube — 1 hook","operatingSystem":"Not exercised","softwareVersion":"5a9356d957db063e4d2cf87511b44cc1ba88dc99"}
review input
{"claims":[{"field":"summary","id":"acquired","sources":["LOCK.json","listing.json","commands.json"],"text":"Pinned source declarations and file hashes were listed."},{"field":"outcome","id":"listed","sources":["LOCK.json","listing.json","commands.json"],"text":"Listed 1 hook declaration. Ran 46 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection."},{"field":"rule_results.0","id":"tree","sources":["LOCK.json","listing.json","commands.json"],"text":"The retained source tree matches its acquisition manifest."},{"field":"rule_results.1","id":"declared","sources":["LOCK.json","listing.json","commands.json"],"text":"Declared hook names (listing.json): SessionStart"}],"evidence_sha256":{"LOCK.json":"a7bfbe38ddfee634df40cbb4b17eb11df862eebac1024fec66511942fa74e61b","commands.json":"d4bb485bf73bfac84bb1c3ebaebe0cee6365de45595720a784e1c23d4d8ce163","complete.json":"91b504b43905fdc009504d516c45eea831f39a1995b9e7d69987c9756c936d6f","identity.json":"af089c258d5b51ff205492c92f29856eaf88de64abd2c89f2906270becadd294","listing.json":"d6b89b7080a0ebfe5889eb33305f4aa6985f14fa2642f953be007924f4fa8262","selection.json":"41766fd4a9c6175d70545cb5ea218f02b12fe89c6528308986313c43799abc62"},"identity_artifact":"identity.json"}
review
{"codex":"7ddf6a5af40e8180ecf4066f2255b007bdc00601d80745c7cf78d301b1002b35","date":"2026-10-19","gates":"4169943a4d87b04888b780e5f5bb999ab40efed51603216259305c572540d8a4","grok":"d9d70696aec3d7394bbc12bcc2af3bd6a4414b2b4d2861b5db3355c94b56ace3","kind":"machine-checked","reviewed_sha256":"de9bf5c9b96bc807b1df111f93f0553d4818c3a01b92950260a5a2bf266474b0","summary":"Deterministic gates passed; every claim rebuilt from evidence with a reviewed template; Grok reported no standing refutation."}

Downloadable evidence

transcript

Download complete transcript

Ran 46 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.

sinkhole log

Download complete sinkhole log

Not applicable: static source inspection (commands.json).

canary log

Download complete canary log

Not applicable: static source inspection (commands.json).

scanner output

Download complete scanner output

Not applicable: static source inspection (commands.json).

normalized text

Download complete normalized text

{
  "listing": {
    "skills": [
      {
        "path": "skills/sonar-analyze/SKILL.md",
        "name": "sonar-analyze",
        "description": "Analyze a file for quality and security issues using SonarQube",
        "files": {
          "skills/sonar-analyze/SKILL.md": "575142711c38ff1d50b2b74c5de9a1be19cb050bd58c0a562716ac2779e0c87b"
        }
      },
      {
        "path": "skills/sonar-coverage/SKILL.md",
        "name": "sonar-coverage",
        "description": "Find files with low test coverage and inspect uncovered lines in a SonarQube project (project key optional when MCP integration already defines the default project)",
        "files": {
          "skills/sonar-coverage/SKILL.md": "cffca8cab282592be0c786566e7ca9828d5fa3d68e658717a9734591a58814a1"
        }
      },
      {
        "path": "skills/sonar-dependency-risks/SKILL.md",
        "name": "sonar-dependency-risks",
        "description": "Search for software composition analysis (SCA) dependency risks in a SonarQube project (project key optional when MCP integration already defines the default project)",
        "files": {
          "skills/sonar-dependency-risks/SKILL.md": "15b26da2d3298f6739d262344eebe9e3a71e6b02d87573003ef4b74ab7f96a96"
        }
      },
      {
        "path": "skills/sonar-duplication/SKILL.md",
        "name": "sonar-duplication",
        "description": "Find files with code duplications in a SonarQube project and inspect duplication blocks for a file (project key optional when MCP integration already defines the default project)",
        "files": {
          "skills/sonar-duplication/SKILL.md": "a73546e05609daf1d47068e2852590c7ae8527e454443c61dc25ffcc5dec46a3"
        }
      },
      {
        "path": "skills/sonar-fix-issue/SKILL.md",
        "name": "sonar-fix-issue",
        "description": "Fix a specific SonarQube issue in code by rule key and location",
        "files": {
          "skills/sonar-fix-issue/SKILL.md": "6b57ea6a2b6348b53dc20c0bbe79e27e4fd8520d67c30f

Excerpt shown; complete evidence is in the download.

Download full record JSON

Disclaimer

This record lists declarations and file hashes from a pinned source tree. Git command results from acquisition and static inspection are retained in commands.json. Scope: acquisition and static inspection. It is not a security or quality verdict. Changed bytes are outside this record.

Template placeholders refer to the snapshot metadata above.

Page updated