菜单
Query SonarCloud API for code quality data. Use when: checking quality gate status, fetching code issues or security hotspots, reviewing metrics (coverage, bugs, code smells), or the user says "sonar", "quality gate", "code quality", "sonarclaude".
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Ask colleague — a *different* backend/model than you (e.g. a local vLLM Qwen) — to take a scoped repo task off your plate, then fold its answer back. The point isn't a stronger model; it's a second, independent mind, and that diversity is the value: `ask-colleague review` gets a candid second opinion on a diff, `ask-colleague explore` gets a fresh read of an area, `ask-colleague write` hands off a small implementation, `ask-colleague feedback` grades a finished work item (the ROI loop), and `ask-colleague clean` reaps stale/corrupt `colleague/*` branches a crashed run left behind (which can break `git fetch`). Pilot a running work item with `monitor`/`guide`/`stop`. Reach for it REFLEXIVELY, the way you'd lean over to the teammate at the next desk — not only when asked: before you present or open a PR on a non-trivial committed diff, run `review` for a diverse second opinion; for a fresh read of an unfamiliar area whose answer is independent of your current context, run `explore`. Both are read-only — isolate
Run a risk-scaled blind-spot discovery pass over a converged, exported frame BETWEEN /think and /spec-to-plan (the seventh origin skill, third leg in flow order): pressure-test the spec through structured lenses, route every finding back through the existing deterministic moves as proposed-only content the human adjudicates, and on a clean pass record the examined lenses/surfaces and residual uncertainty — never a claim that there are no unknown unknowns. Use when the user says "challenge this spec", "blind-spot pass", "pressure-test the frame", "what are we missing", "unknown unknowns", or after /think exports and before `devague plan new`. Authored and maintained in agentculture/devague (origin = devague); guildmaster pulls this skill from here and broadcasts it to the AgentCulture mesh — it is NOT vendored from guildmaster like the inbound skills here.
Stop an in-flight assign-to-workforce run the moment execution must diverge from the confirmed plan, get explicit human approval for the divergence, and record it as a first-class, append-only deviation record via `devague deviate` before resuming — never fold a deviation silently into drift after the fact. Use when the user says "deviate from the plan", "we need to change the plan mid-run", "record a deviation", "this isn't matching the plan anymore", or when a task agent discovers the confirmed plan no longer matches reality partway through a workforce run. Authored and maintained in agentculture/devague (origin = devague); guildmaster pulls this skill from here and broadcasts it to the AgentCulture mesh — it is NOT vendored from guildmaster like the inbound skills here.
Explore the scope of a vague idea BEFORE framing it into a spec (the idea→scope leg; the optional opening move ahead of /think). Survey the surfaces the idea touches — code, docs, skills, CI, sibling repos — and seed the coming Announcement Frame with boundary, non-goal, and assumption claims that cite what was actually explored (provenance, not generic disclaimers). Use when the user says "explore scope", "scope this idea", "what does this touch", "map the scope", "scope exploration", or when an idea touches an existing codebase and speccing it cold would mean guessing its boundaries. Hand off to the sibling /think skill to build the frame. Authored and maintained in agentculture/devague (origin = devague); guildmaster pulls this skill from here and broadcasts it to the AgentCulture mesh — it is NOT vendored from guildmaster like the inbound skills here.
Close the loop after an assign-to-workforce run by turning what actually happened into an accountability artifact — planned versus actual delivery, mid-work decisions, plan drift, evidence-backed delivery claims, and remaining work. The plan the user confirmed is the contract; this skill records where execution obeyed it, where it changed, and what is genuinely safe to claim as delivered. Runs on complete, partial, AND failed runs — failure is reported faithfully, never smoothed over. Use when the user says "summarize delivery", "delivery summary", "wrap up", "close the loop", "what did we actually ship", or "plan versus actual", or after assign-to-workforce merges (or fails to merge) a plan's waves. Authored and maintained in agentculture/devague (origin = devague); guildmaster pulls this skill from here and broadcasts it to the AgentCulture mesh — it is NOT vendored from guildmaster like the inbound skills here.
Search the shared eidetic memory store and get back ranked, provenanced records. Drives `eidetic recall` with four search modes — exact (verbatim substring), approximate (vector/semantic), keyword (BM25 lexical), and hybrid (a weighted blend of vector+keyword, the default) — each hit carrying its text, full metadata, a relevance `score`, and a freshness `signal`. Recall passively reinforces matched records (bumps last_recall + recall_count). Shadowed and archived records are excluded by default; use --include-shadowed / --include-archived to retrieve them. The store lives at ~/.eidetic/memory (a home-dir path outside any git worktree); the wrapper defaults queries to this agent's PERSONAL, PRIVATE scope (`--scope reachy-mini-mcp --visibility private`, suffix read from culture.yaml) — matching where /remember writes — so a no-flag recall returns this agent's own private records plus the shared public pool, and Claude and the colleague backend recall each other's memories because both resolve the same suffix vi
| name | sonarclaude |
| type | command |
| description | Query SonarCloud API for code quality data. Use when: checking quality gate status, fetching code issues or security hotspots, reviewing metrics (coverage, bugs, code smells), or the user says "sonar", "quality gate", "code quality", "sonarclaude". |
Query SonarCloud projects for quality gate status, issues, metrics, and security hotspots.
The script requires the following tools on PATH:
bashcurl — talks to the SonarCloud REST APIjq — parses responses and URL-encodes accept commentsRequires SONAR_TOKEN environment variable. Set the project key per-repo via
the SONAR_PROJECT environment variable (or pass --project KEY on each
invocation).
# Quality gate status (pass/fail)
bash .claude/skills/sonarclaude/scripts/sonar.sh status
# List issues (bugs, vulnerabilities, code smells)
bash .claude/skills/sonarclaude/scripts/sonar.sh issues
# Filter issues by severity and type
bash .claude/skills/sonarclaude/scripts/sonar.sh issues --severity CRITICAL --type BUG
# Key metrics (coverage, bugs, code smells, duplication, LOC)
bash .claude/skills/sonarclaude/scripts/sonar.sh metrics
# Security hotspots
bash .claude/skills/sonarclaude/scripts/sonar.sh hotspots
# Accept (won't-fix) an OPEN issue with a rationale comment
bash .claude/skills/sonarclaude/scripts/sonar.sh accept \
--issue AZ3Ep83i4ywi8V_l99p0 \
--comment "Pushback: rule premise doesn't fit our test fixture pattern."
# Different project
bash .claude/skills/sonarclaude/scripts/sonar.sh status --project OtherOrg_OtherProject
# Raw JSON output
bash .claude/skills/sonarclaude/scripts/sonar.sh issues --raw
# Limit results
bash .claude/skills/sonarclaude/scripts/sonar.sh issues --limit 10
| Flag | Default | Description |
|---|---|---|
--project | $SONAR_PROJECT | SonarCloud project key |
--severity | all | Filter: BLOCKER, CRITICAL, MAJOR, MINOR, INFO |
--type | all | Filter: BUG, VULNERABILITY, CODE_SMELL |
--limit | 25 | Max results returned |
--raw | off | Output raw JSON instead of formatted summary |
--issue | — | Issue key (required for accept) |
--comment | — | Rationale comment (required for accept) |
acceptSonar rules occasionally flag patterns where the rule's premise does not fit the
code (e.g. test fixtures with intentional bad-password literals, contradictory
rule pairs like S7494 vs S7500). After deciding pushback in PR review, run
sonar.sh accept with a rationale comment instead of leaving the issue OPEN —
this moves it to ACCEPTED/WONTFIX in SonarCloud history (visible to future
maintainers) while clearing the quality-gate signal. Always include a --comment
explaining why; silent dismissals are not acceptable curation.
Do not call SonarCloud's HTTP API directly from other skills or one-off
scripts — sonar.sh accept is the supported entry point so the rationale
flow stays consistent.