scanning-tools

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt contains examples that embed API keys on the command line (e.g., zap.sh -daemon ... -config api.key=<your_key>), which would require the agent to accept and place secret values verbatim into generated commands — an exfiltration risk.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs use of sudo, installing packages, starting/stopping system services (e.g., systemctl start nessusd, sudo apt install openvas), enabling monitor mode, and generating remediation scripts—actions that modify the host system state and require elevated privileges.