ray-data

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill contains a code example that embeds a plaintext DB DSN with "user:pass" (a username:password in a URL), which demonstrates and encourages including secret credentials verbatim in generated code or commands.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The Airflow Ray job runtime_env sets a remote working_dir that Ray will fetch and execute at job runtime (working_dir "s3://my-bucket/code/pipeline/"), so remote code from that S3 URL is pulled and run as part of the skill.