bare-metal

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill's scripts and client explicitly take secrets (BMC admin passwords and MAAS API key) from config/CLI and embed them verbatim into subprocess command arguments and HTTP Authorization headers, which forces the agent to handle/output secret values directly and is high risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Multiple URLs point to plain-HTTP network-boot assets and an unsigned .exe on an untrusted "repo" host — these are high-risk vectors because boot images (vmlinuz/initrd/IPXE scripts/ISOs) and direct executables delivered over HTTP from unverified/non-official hosts can be used to distribute stealthy malware at install/boot time.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill includes scripts that modify system files and services (apt installs, writing /etc/dhcp/dhcpd.conf, systemctl restarts, creating directories under /var, RAID controller changes) and automation that creates users on BMCs via ipmitool — all actions that change the host or attached hardware state and require elevated privileges.