migrate-to-teamcity

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt instructs embedding secrets directly into CLI commands (e.g., teamcity project token put <project> <value>), which requires the LLM/agent to handle and output secret values verbatim, creating an exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The repository contains explicit runtime curl/download commands that the converter will emit into generated pipeline steps and thus would fetch and execute remote code at runtime (e.g. https://go.dev/dl/go1.23.8.linux-amd64.tar.gz, https://cli.codecov.io/latest/linux/codecov, https://goreleaser.com/static/run), which is high-risk.