recovering-from-ransomware-attack

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill embeds hardcoded plaintext passwords in PowerShell commands (e.g., "NewKrbtgt2026!Complex#1"/"NewKrbtgt2026!Complex#2"), forcing the LLM to include secret values verbatim in generated output.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill contains explicit privileged system and network commands (e.g., VLAN/firewall setup, mounting devices, wbadmin/PowerShell AD restores and password resets, installing updates) that instruct performing administrative changes to hosts and infrastructure, which would modify the machine/state the agent runs on or other systems and therefore must be flagged.