django-tdd

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill prompt embeds multiple hard-coded passwords and a payment token (e.g. 'testpass123', 'adminpass123', 'tok_visa') directly in example code and tests, which would require an LLM to reproduce those secret-like values verbatim if it outputs or generates the same snippets.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill documentation includes explicit references to the Stripe payment gateway API (e.g., patch('apps.payments.services.stripe'), mock_stripe.Charge.create, and payment tokens like 'tok_visa') used in payment processing tests. Stripe is a specific payment gateway API, so this skill includes explicit financial execution capabilities (even though the calls are mocked in tests).