recovering-from-ransomware-attack

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt contains explicit plaintext passwords (e.g., NewKrbtgt2026!Complex#1 / NewKrbtgt2026!Complex#2) and PowerShell commands that set credentials verbatim, forcing the LLM to handle and reproduce secret values.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill contains explicit, high-risk instructions that modify system state and require administrative privileges—e.g., creating VLANs and firewall rules, restoring AD in DSRM, resetting krbtgt and privileged account passwords, mounting backups, performing instant VM recoveries and migrations, and installing updates—so it pushes the agent to perform privileged state-changing actions on the host/environment.