From sonarcloud-security-updating
Update SonarCloud security issues by applying triage decisions from JSON or CSV files. Use when the user has reviewed security issues and wants to bulk-update SonarCloud with their triage decisions, apply security review outcomes, or change issue statuses.
How this skill is triggered — by the user, by Claude, or both
Slash command
/sonarcloud-security-updating:sonarcloud-security-updatingThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
This skill applies triage decisions to SonarCloud security issues (vulnerabilities and hotspots) by reading JSON or CSV files with review decisions and updating the statuses in SonarCloud via the API.
This skill applies triage decisions to SonarCloud security issues (vulnerabilities and hotspots) by reading JSON or CSV files with review decisions and updating the statuses in SonarCloud via the API.
sonarcloud-security-triaging skill
This skill complements the export and triage skills:
sonarcloud-security-exporting generates JSON with rich datasonarcloud-security-triaging populates triage fieldssonarcloud-security-exporting generates CSVThe JSON file should contain issues with populated triage fields (output from sonarcloud-security-triaging skill):
{
"exportMetadata": { ... },
"issues": [
{
"key": "AZPV1fTprahIrD-njDRb",
"project": "NASA-PDS_doi-ui",
"type": "SECURITY_HOTSPOT",
"url": "https://sonarcloud.io/...",
"triage": {
"action": "REVIEWED",
"resolution": "SAFE",
"comment": "This is a namespace URI, not an HTTP connection",
"reviewer": "claude-code",
"confidence": "HIGH"
}
},
{
"key": "AZnP1S0b_yFrdYV3Iu6e",
"project": "NASA-PDS_data-upload",
"type": "VULNERABILITY",
"url": "https://sonarcloud.io/...",
"triage": {
"action": "wontfix",
"comment": "Scheduled for future sprint",
"reviewer": "claude-code"
}
}
]
}
What gets applied:
triage field populated (not null) are processedaction, resolution, and comment from triage objectkey used directly (no URL parsing needed)The CSV must have these columns (export + 4 triage columns):
Original columns:
Added triage columns:
REVIEWED | For VULNERABILITY: confirm, falsepositive, wontfix, resolveSAFE or FIXEDExample:
Project,Type,Severity,Status,Rule,Message,Component,Line,Created,URL,Action,Resolution,Comment,Reviewer
NASA-PDS_doi-ui,SECURITY_HOTSPOT,,TO_REVIEW,,Using http protocol...,src/file.jsx,119,2021-01-28T19:38:04+0000,https://sonarcloud.io/.../hotspots=AZPV1fTprahIrD-njDRb,REVIEWED,SAFE,"URI not URL",[email protected]
NASA-PDS_data-upload,VULNERABILITY,MAJOR,OPEN,python:S7608,Add ExpectedBucketOwner...,src/sync.py,134,2025-10-10T20:33:50+0000,https://sonarcloud.io/.../open=AZnP1S0b_yFrdYV3Iu6e&...,wontfix,,"Scheduled for future sprint",[email protected]
Verify the SonarCloud token is set:
env | grep SONARCLOUD_TOKEN
If not set, prompt the user to set it (same token used for audit skill).
For JSON: Check that the file exists and has valid structure:
issues arraytriage field populated (not null)triage.action will be processedFor CSV: Check that the file exists and has required columns:
Execute the script (auto-detects format):
cd sonarcloud-security-updating
node scripts/apply-triage.mjs <path-to-triaged.json> [--dry-run]
cd sonarcloud-security-updating
node scripts/apply-triage.mjs <path-to-triaged.csv> [--dry-run]
Parameters:
<path-to-file> (required): Path to JSON or CSV file with triage decisions--dry-run (optional): Preview changes without actually updating SonarCloudFormat detection: Automatic based on file extension (.json or .csv) or content inspection
The script will:
For JSON input:
triage is not null and triage.action is setkey directly (no URL parsing)POST /api/hotspots/change_status
hotspot=key, status=REVIEWED, resolution=triage.resolution, comment=triage.commentPOST /api/issues/do_transition
issue=key, transition=triage.action, comment=triage.commentFor CSV input:
POST /api/hotspots/change_status
hotspot, status=REVIEWED, resolution (SAFE/FIXED), commentPOST /api/issues/do_transition
issue, transition (confirm/falsepositive/wontfix/resolve), commentThe script outputs:
After running, verify a few updates in the SonarCloud UI:
Endpoint: POST /api/hotspots/change_status
Parameters:
hotspot (required): Hotspot key extracted from URL (e.g., AZPV1fTprahIrD-njDRb)status (required): Always REVIEWEDresolution (required): SAFE or FIXEDcomment (optional): Review explanationExample:
curl -X POST 'https://sonarcloud.io/api/hotspots/change_status' \
-H 'Authorization: Bearer <token>' \
-d 'hotspot=AZPV1fTprahIrD-njDRb' \
-d 'status=REVIEWED' \
-d 'resolution=SAFE' \
-d 'comment=False positive. This is a URI not a URL.'
Endpoint: POST /api/issues/do_transition
Parameters:
issue (required): Issue key extracted from URL (e.g., AZnP1S0b_yFrdYV3Iu6e)transition (required): One of confirm, falsepositive, wontfix, resolvecomment (optional): Explanation for the transitionExample:
curl -X POST 'https://sonarcloud.io/api/issues/do_transition' \
-H 'Authorization: Bearer <token>' \
-d 'issue=AZnP1S0b_yFrdYV3Iu6e' \
-d 'transition=wontfix' \
-d 'comment=Scheduled for future sprint'
The script extracts issue/hotspot keys from the URL column:
Security Hotspot URL:
https://sonarcloud.io/project/security_hotspots?id=NASA-PDS_doi-ui&hotspots=AZPV1fTprahIrD-njDRb
^^^^^^^^^^^^^^^^^^^^^^
Extract this part
Vulnerability URL:
https://sonarcloud.io/project/issues?open=AZnP1S0b_yFrdYV3Iu6e&id=NASA-PDS_data-upload
^^^^^^^^^^^^^^^^^^^^^
Extract this part
Before applying changes, use --dry-run to preview:
JSON:
node scripts/apply-triage.mjs issues-triaged.json --dry-run
CSV:
node scripts/apply-triage.mjs triage.csv --dry-run
Dry run output:
[DRY RUN] Would update hotspot AZPV1fTprahIrD-njDRb:
Project: NASA-PDS_doi-ui
Type: SECURITY_HOTSPOT
Action: Change status to REVIEWED (SAFE)
Comment: "False positive. This is a URI not a URL."
[DRY RUN] Would update issue AZnP1S0b_yFrdYV3Iu6e:
Project: NASA-PDS_data-upload
Type: VULNERABILITY
Action: Transition to wontfix
Comment: "Scheduled for future sprint"
Summary: 2 updates would be applied (0 errors)
triage.reviewer, CSV: Reviewer column)"No issues with triage decisions found"
triage fields are nullsonarcloud-security-triaging skill first to populate triage decisions"Invalid triage action"
triage.action must be valid for the issue typeREVIEWED, resolution=SAFE|FIXEDconfirm|falsepositive|wontfix|resolve"JSON parse error"
jq '.' file.json to validate JSON syntax"Column 'Action' not found"
"Could not extract hotspot key from URL"
hotspots= or open= parameter"No rows to process"
"Invalid resolution: must be SAFE or FIXED"
SAFE or FIXEDcd sonarcloud-security-exporting
node scripts/fetch-security-issues.mjs nasa-pds issues.json --format json --include-snippets
Output: issues.json with code context and rule details
# Use sonarcloud-security-triaging skill
# Claude reads issues.json, analyzes code context, suggests decisions
# Output: issues-triaged.json with populated triage fields
cd sonarcloud-security-updating
node scripts/apply-triage.mjs ../issues-triaged.json --dry-run
node scripts/apply-triage.mjs ../issues-triaged.json
Total time: ~15-30 minutes for thousands of issues (mostly automated)
cd sonarcloud-security-exporting
node scripts/fetch-security-issues.mjs nasa-pds security-audit.csv
Open security-audit.csv in Excel/Google Sheets and add 4 columns:
| Action | Resolution | Comment | Reviewer |
|---|---|---|---|
| REVIEWED | SAFE | False positive. Uses URI not URL. | [email protected] |
| wontfix | Low priority. Scheduled for Q2. | [email protected] |
Save as security-triage.csv
cd sonarcloud-security-updating
node scripts/apply-triage.mjs ../security-triage.csv --dry-run
node scripts/apply-triage.mjs ../security-triage.csv
Total time: Several hours to days (manual spreadsheet review, URL parsing)
Console output:
🔧 SonarCloud Security Triage
Input file: security-triage.csv
Dry run: NO
Total rows: 4647
Rows with triage decisions: 127
Processing...
[1/127] ✅ Hotspot AZPV1fTprahIrD-njDRb → REVIEWED (SAFE)
[2/127] ✅ Issue AZnP1S0b_yFrdYV3Iu6e → wontfix
[3/127] ⚠️ Hotspot ABC123 → 404 Not Found (skipped)
...
📊 Summary:
✅ Successfully updated: 125
❌ Failed: 1
⏭️ Skipped: 1
Failed updates:
- Row 45: Hotspot XYZ789 - 403 Forbidden (insufficient permissions)
All done!
npx claudepluginhub riverma/pds-agent-marketplace --plugin creating-pds-issuesProvides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.