firmware-analyst

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs searching for hardcoded credentials and private keys (e.g., grep for "password", "api_key", "BEGIN RSA PRIVATE KEY") and includes a reporting template/POC section, which implies the agent will extract and output secret values verbatim in findings.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs privileged operations (sudo chroot), raw device access (dd from /dev/mtd0), and package installation (apt install), which push the agent to perform actions that require elevated privileges and can modify the host system state.