python-fastapi

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill embeds plaintext credential-like values (a database URL with user:pass, a default secret_key, and example passwords/.env references) so an LLM following the prompt would likely reproduce those secret-like strings verbatim in generated project files, creating an exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The URL https://astral.sh/uv/install.sh is suspicious because it is a remote shell script referenced for piping into sh (curl ... | sh), a high-risk supply-chain/install pattern; the other links are documentation/GitHub/test placeholders and not direct downloads.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.97). The skill includes a setup step that fetches and immediately executes a remote installer via curl -LsSf https://astral.sh/uv/install.sh | sh, which downloads and runs remote code during runtime.