django-verification

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill includes hardcoded plaintext credentials embedded in commands and CI environment variables (e.g., superuser creation and GitHub Actions env), which would require the model to handle or reproduce secret values verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The workflow references external GitHub Actions (actions/checkout@v3, actions/setup-python@v4, actions/cache@v3, codecov/codecov-action@v3) and pulls a Docker image (postgres:14) which are fetched and executed at runtime in the CI workflow, so external code is executed by the skill.