forensics-checklist

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill includes explicit privileged on-host commands (e.g., "sudo insmod" for LiME and raw disk imaging of /dev/sda with dc3dd/FTK) which instruct inserting a kernel module and performing bit‑for‑bit images — actions that require root and modify system state.