gitea

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt includes examples that embed passwords and plaintext credentials directly in CLI commands and config fields (e.g., --password <pass>, PASSWD), which encourages an agent to accept and echo secrets verbatim in generated commands or outputs.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill contains explicit commands that modify system state (systemctl service control, editing /etc/gitea/app.ini, regenerating ~git/.ssh/authorized_keys, and running sudo ufw) which require elevated privileges and can change the host system configuration.