memory-forensics-volatility

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The playbook explicitly instructs using tools/commands (e.g., mimikatz, lsadump, hashdump, filescan | grep "password|secret") that extract plaintext credentials and secrets from memory, which would require the agent to handle and likely output those secret values verbatim.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly instructs actions that change system state and require elevated privileges (e.g., inserting a kernel module with insmod, reading /proc/kcore, running virsh dump, and placing files into system plugin directories), so it pushes the agent to perform privileged, state-modifying operations on the host.