django-verification

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes example commands and CI config that embed plaintext credentials (e.g., create_superuser with 'admin', DATABASE_URL and DJANGO_SECRET_KEY in the workflow), which would cause an agent to output secret values verbatim—an insecure pattern.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The workflow references and will fetch/execute third-party GitHub Actions at runtime (e.g., actions/checkout@v3, actions/setup-python@v4, actions/cache@v3, codecov/codecov-action@v3), which are remote repositories that are downloaded and run as code during CI, creating a supply-chain execution risk.