django-tdd

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes plaintext passwords and test tokens (e.g., 'testpass123', 'adminpass123', 'tok_visa') inline in fixtures and tests, which requires the LLM to reproduce secret values verbatim in generated code or outputs and therefore constitutes insecure credential handling.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill documentation includes explicit references to a payment gateway API (Stripe) and tests that patch and call stripe.Charge.create (mocking actual charge creation), as well as a checkout payment processing function (apps.checkout.services.process_payment). These are specific payment-related integrations (payment gateway / transaction sending), which constitutes direct financial execution capability.