cicd-pipeline

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill contains plaintext credentials (e.g., POSTGRES_PASSWORD and DATABASE_URL with "testpass") embedded in YAML examples, meaning an LLM would need to reproduce secret values verbatim when generating or modifying pipeline code.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.85). The workflow files reference and "uses:" many external GitHub Actions and container images (for example actions/checkout@v4, docker/build-push-action@v5, aquasecurity/trivy-action@master, aquasec/trivy:latest) which are fetched and executed at runtime, so remote content is executed as part of the pipeline.