winapp-signing

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes and encourages embedding plaintext PFX passwords directly in CLI flags and examples (e.g., --password MySecurePassword, default password), which requires the LLM to handle or produce secret values verbatim and is an exfiltration risk.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs installing/trusting certificates into the machine's Trusted Root store (via winapp cert install and --install), requires administrative/elevated privileges, and thus modifies persistent system security state that can be abused to compromise the machine.