containment

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill prescribes numerous privileged, state-changing containment actions (disable/modify accounts including krbtgt resets, firewall/cloud security group changes, VLAN/isolation, power-off hosts, modify autostart/systemd entries, revoke keys/tokens, etc.) that would modify system or network state and require administrative/sudo privileges — so it pushes guidance to change the running environment even if it includes a "do not execute" notice.