analyzing-memory-dumps-with-volatility

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs extracting credentials, keys, and plaintext/decrypted secrets from memory and includes an "EXTRACTED CREDENTIALS" report section, which requires the agent to handle and output secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow ingests the contents of an outsider-provided memory dump file (e.g., acquired from the target system) and passes Volatility plugin stdout/stderr (free-form text derived from that dump) into the agent’s processing/LLM context, creating an indirect prompt-injection path via attacker-controlled in-memory strings.