django-verification

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes hardcoded credentials and example environment variable values (e.g., POSTGRES_PASSWORD, DATABASE_URL with embedded password, DJANGO_SECRET_KEY, and an explicit superuser password) that the LLM would reproduce verbatim when generating the CI/config/command snippets, so it requires handling/outputting secret values directly.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The GitHub Actions "uses" entries (e.g., actions/checkout@v3, actions/setup-python@v4, actions/cache@v3, codecov/codecov-action@v3) in the CI workflow are fetched and executed at runtime by GitHub Actions, meaning remote code will run as part of the skill's CI job.