Skills Guide

Fix a SonarQube Issue

VerifiedSafe

Fix a code quality or security issue identified by SonarQube using rule key and location.

Download and use
Sby Skills Guide Bot
DevelopmentIntermediate
7/23/2026
Claude Code
#sonarqube#code-quality#static-analysis#remediation#mcp

Recommended for

Backend developerClaude CodeCode reviewFrontend developerFullstack developerRefactoring

Automated summary

Fixes a single SonarQube violation by resolving the rule and location, then applying the minimal code change in the affected file.

Strengths

  • Enforces a minimal edit that preserves existing behaviour, reducing regression risk
  • Fetches the rule description and remediation guidance from the SonarQube MCP server before editing
  • Accepts a rule key (java:S1481), a file:line path, or a plain-language description
  • Explains the violation and the fix, then points to the sonar-analyze and sonar-list-issues skills

Limitations

  • Relies on the SonarQube MCP server for rule lookup and falls back to model knowledge if it is unavailable
  • Handles one issue at a time rather than sweeping a whole project
  • Restricted to Read and Edit tools, so it cannot run tests or analysis to verify the fix
When to use it

Use it when a SonarQube report points to a specific rule and location you want fixed without disturbing surrounding code.

When not to use it

Avoid it for large-scale quality cleanups or for confirming that no new issues appeared, which other skills cover.

Security analysis

Safe
Quality score76/100

The skill only reads files and applies targeted edits to fix a lint/security finding. It contains no shell execution, network calls, credential handling, obfuscated payloads, or instructions to disable safety mechanisms. The one inconsistency is that it calls a SonarQube MCP lookup tool that is not in its declared allowed-tools list, which is a capability mismatch rather than a risk. Overall, execution risk is low.

Findings
  • •Declared allowed-tools (Read, Edit) do not include the MCP tool `mcp__sonarqube__show_rule` referenced in Step 2, so the workflow may partially fail depending on how the harness enforces the allowlist (functional, not a security issue).
  • •Skill mutates source files via Edit, but instructs minimal, behavior-preserving changes and requires reading the whole file first — no destructive or bulk-rewrite behavior.
How this analysis is made

Examples

Fix unused variable
sonar-fix-issue java:S1481 src/main/java/MyClass.java:42
Fix SQL injection warning
sonar-fix-issue python:S2077 src/auth/login.py
Plain-language request
Fix the SonarQube issue about the unused variable in MyClass.java

name: sonar-fix-issue description: Fix a specific SonarQube issue in code by rule key and location argument-hint: "[rule-key] [file-path:line]" allowed-tools: Read, Edit

SonarQube — Fix Issue

Fix a code quality or security issue identified by SonarQube.

Usage

sonar-fix-issue java:S1481 src/main/java/MyClass.java:42
sonar-fix-issue python:S2077 src/auth/login.py
sonar-fix-issue Remove unused variable in MyClass.java

Instructions

Step 1: Identify the issue

Parse the user-provided arguments for:

  • A rule key (e.g. java:S1481, python:S2077)
  • A file path and optional line number (e.g. src/auth/login.py:34)
  • Or a plain-language description if no rule key is given

If neither a rule key nor a file path can be determined, ask: "Which rule and file should I fix?"

Step 2: Look up the rule (if a key was given)

Call mcp__sonarqube__show_rule with the rule key to retrieve the full rule description, rationale, and remediation guidance before touching any code. Do not add extra parameters (such as projectKey) unless the tool schema requires them — after integration, rule lookup usually needs only the rule key.

If the MCP server is unavailable, rely on built-in knowledge of SonarQube rules.

Step 3: Read the file

Read the full file content. If a line number was given, focus analysis around that line but read the whole file to understand context.

Step 4: Apply the fix

  • Make the minimal change that resolves the rule violation
  • Do not refactor surrounding code or fix unrelated issues
  • Preserve existing behaviour — the fix must not change what the code does

Step 5: Explain the change

After editing, briefly explain:

  • What the violation was
  • Why the rule flags it
  • What was changed and why it resolves the issue

Step 6: Suggest next steps

  • "Invoke the sonar-analyze skill with <file> to confirm no new issues were introduced."
  • "Invoke the sonar-list-issues skill with the project key (or sonar.projectKey in sonar-project.properties) — the CLI always uses -p."

From the file to a first result

The download contains exactly the content displayed on this page. This copy may differ from the latest version in the source repository.

View the source and supporting files

This download contains SKILL.md only. Any scripts, references, templates and dependencies are not included. Get the required files from the source, preserving their directory structure, before continuing.

1. Download the file

Download SKILL.md

From the root of a test project, save the file as .skill-downloads/fix-a-sonarqube-issue-mrx3xyl8/SKILL.md, or use the command below. This folder is for inspecting the skill before installation.

Command for macOS/Linux or WSL: requires a POSIX shell and curl. On Windows without WSL, use the download button and create the folder manually.

mkdir -p '.skill-downloads/fix-a-sonarqube-issue-mrx3xyl8' && curl --fail --show-error --location 'https://skills-guides.com/api/skills/fix-a-sonarqube-issue-mrx3xyl8/download' --output '.skill-downloads/fix-a-sonarqube-issue-mrx3xyl8/SKILL.md.part' && mv '.skill-downloads/fix-a-sonarqube-issue-mrx3xyl8/SKILL.md.part' '.skill-downloads/fix-a-sonarqube-issue-mrx3xyl8/SKILL.md'

2. Check prerequisites

Read SKILL.md before using it. If it references scripts or external services, inspect them and prepare the required access in your test environment.

Tools declared by the author (check availability in your agent): Read, Edit

No recognized prerequisites section in this file. This does not mean it is self-contained: libraries, tools and access requirements may be mentioned elsewhere in the content or source repository.

The platforms on this page are catalog indications. The paths below follow tool documentation; they do not prove this skill has been run in those tools. No minimum tool version is confirmed for this listing.

3. Load the skill

After inspection, copy the complete folder into your project using one of the commands below, then open a new tool session. The command stops if a folder with the same name already exists: compare the files before replacing it.

Claude Code
test -f '.skill-downloads/fix-a-sonarqube-issue-mrx3xyl8/SKILL.md' && test -s '.skill-downloads/fix-a-sonarqube-issue-mrx3xyl8/SKILL.md' && mkdir -p '.claude/skills' && test ! -e '.claude/skills/sonar-fix-issue' && cp -R '.skill-downloads/fix-a-sonarqube-issue-mrx3xyl8' '.claude/skills/sonar-fix-issue'

OpenSkills

OpenSkills must already be installed. The local install/read procedure is checked with OpenSkills 1.5.0, which requires Node.js ≥ 20.6.0. Catalog slugs are not resolved automatically.

Official OpenSkills installation
openskills install './.skill-downloads/fix-a-sonarqube-issue-mrx3xyl8'

openskills read 'fix-a-sonarqube-issue-mrx3xyl8'

Reading should display the installed file content and its base directory. It does not run the skill or install its dependencies.

For an agent that reads AGENTS.md, then sync the index. This command changes AGENTS.md: review the diff before using it.

openskills sync

Manual method or another tool: attach SKILL.md to a conversation, or open it in an agent that can read files. Include any required supporting resources. No universal folder is recognized by every tool.

4. Try a first task

Use a short, synthetic input: an API endpoint, a small document or an interface brief. In a new conversation, attach the file or give the agent its path, then adapt this request:

Read .skill-downloads/fix-a-sonarqube-issue-mrx3xyl8/SKILL.md and apply its instructions to this example: [describe a test input]. Identify any missing files, dependencies or access. Produce the result requested by the skill without inventing data or running unreviewed scripts.

Expected result: output matching the skill instructions, or a precise list of missing prerequisites. A read confirmation alone does not validate a first use. If an external resource is unavailable, that path remains untested.

Related skills

React Hook Form Best Practices

Development

Master React Hook Form: avoid anti-patterns, manage subscriptions, and handle reset, dirty state, and controlled inputs correctly.

Claude CodeCursorWindsurf+2intermediateSafe 108,623
Skills Guide Bot

Emotion to Mantine Migration

Development

Migrate Emotion styled-components to Mantine components with style props and CSS modules. Use when converting .styled.tsx files or removing @emotion imports.

Claude CodeCursorWindsurf+1intermediateSafe 48,981
Skills Guide Bot

Scope Creep Detector

Development

Analyzes git diffs against a stated intent to detect scope creep, unrelated files, broad PRs, and oversized changes, then suggests keep, split, or justify actions.

Claude CodeCursorCodexintermediateSafe 135,015
Skills Guide Bot