performing-timeline-reconstruction-with-plaso

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes a command that embeds credentials verbatim on the command line (timesketch_importer --username analyst --password password), which instructs exposing secrets directly in generated commands and outputs.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill instructs running system-level installation and configuration commands (including explicit sudo apt-get install, adding PPAs, docker-compose up, and creating filesystem paths under /cases), which modify the host system and require elevated privileges, so it pushes the agent to change the machine state.