security-incident-response

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). This skill explicitly instructs automating "isolation" of servers and capturing logs/state (e.g., isolating a server instance, auto-revoking keys, forensic collection), which entails actions that change the host or infrastructure state and likely require elevated privileges, so it pushes the agent to modify the machine/environment.