data-testing

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt embeds plaintext DB connection strings (e.g., "postgresql://user:pass..." and "snowflake://user:pass...") directly in CLI examples, which instructs the agent to place credentials verbatim into commands — a high-risk secret-exfiltration pattern.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The GitHub Actions workflow in SKILL.md fetches and executes external actions (actions/checkout@v4, actions/setup-python@v5) and installs/executes remote packages via pip (e.g., pip install dbt-postgres dbt-unit-testing, pip install soda-core-postgres) and runs dbt deps which will fetch the equalexperts/dbt_unit_testing package at runtime, so these are runtime external dependencies that download and execute remote code.