odoo-agile-scrum-devops

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes a hard-coded database password ("odoo_test_password") in the GitHub Actions service and then reuses it as an environment variable in run steps, which forces any LLM reproducing or modifying the CI configuration to handle and potentially output that secret verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs installing and running pre-commit which will fetch and run hooks from remote repositories (e.g., https://github.com/OCA/pylint-odoo) and its CI workflow references external GitHub Actions that are executed at runtime (e.g., aquasecurity/trivy-action@master), so remote code from those locations would be fetched and run during normal setup/CI.