local-dev-setup

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes explicit credentials (Username: Administrator, Password: password) and example commands that embed those credentials (and use an env var like $CB_ADMIN_PASSWORD), so an LLM following the skill may need to output secret values verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The docker-compose.yml references the external image "couchbase/server:enterprise-8.0.1" which Docker will pull at runtime from Docker Hub and thus fetch and execute remote code that the skill depends on.