incident-response

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill contains explicit instructions that require root privileges and modify system state (e.g., insmod LiME, dd of /dev/sda, killing processes, removing services/persistence, disabling accounts), which push an agent to perform privileged, state-changing operations on the host.