orca-asset-profile

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill instructs the agent to display "sensitive data" alerts and raw IaC "code snippet" contents and to generate remediation (including CLI scripts) with no redaction rules, so secrets or API keys present in the returned data would likely be emitted verbatim.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill explicitly instructs the agent to generate remediation code and write it to files (including .sh/CLI scripts) and to proactively push fixes — which causes the agent to modify the host filesystem and produce executable change scripts that can alter remote/cloud state, even though it does not request sudo or user creation.