opnsense-admin

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill mostly recommends secure storage (env vars / protected credentials file) but the troubleshooting example includes an inline curl with -u "key:secret", which instructs embedding credentials directly in a command and would require the LLM to output secret values verbatim — a high-risk pattern.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs and automates high-privilege changes to a firewall via API/SSH (modifying firewall rules, restarting services, firmware updates, root SSH access) and even documents bypassing SSL validation, which meaningfully enables compromising the state of the managed machine(s).