ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Ctf Crypto

v1.0.0

Provides cryptography attack techniques for CTF challenges. Use when attacking encryption, hashing, signatures, ZKP, PRNG, or mathematical crypto problems in...

⭐ 0· 135·0 current·0 all-time
by@gandli
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The name/description match the content: extensive crypto-CTF techniques and example code for RSA, ECC, lattices, PRNGs, ZKP, etc. The SKILL.md and supporting files only ask for crypto tooling (Python libraries, Sage, hashcat, RsaCtfTool) which are proportionate to the stated purpose.
ℹ
Instruction Scope
SKILL.md contains many runnable examples and explicitly instructs installing Python packages and system tools (pip, apt, brew, git clone). Example code expects reading local ciphertext files (e.g., 'encrypted.bin') and calling solver/oracle patterns; nothing in the instructions directs reading unrelated system secrets or exfiltrating data to remote endpoints. Still: the skill expects the agent to perform package installs and arbitrary code snippets at runtime, which increases operational impact if the agent is allowed to execute actions autonomously.
ℹ
Install Mechanism
There is no formal install spec in the registry (instruction-only), but SKILL.md tells the agent to pip install multiple packages, apt/brew install Sage/hashcat, and git-clone RsaCtfTool from GitHub. These are standard and from known hosts, but because installs are performed ad hoc at runtime (not via a registry install block), the agent may attempt to fetch and run installers dynamically — review and constrain that behavior if you don't want on-demand package installation.
✓
Credentials
The skill does not request environment variables, credentials, or config paths. Code samples operate on local files and mathematical objects; no hidden credential access or unrelated variables are requested. This is proportionate to a crypto-CTF reference.
✓
Persistence & Privilege
The skill is not 'always' enabled and has no install-time persistence. It's instruction-only and contains no code files to persist configuration or modify other skills. The default ability for the agent to invoke the skill autonomously is platform-standard; this skill does not request elevated agent privileges.
Assessment
This skill is an offline reference of CTF crypto attack techniques and is internally consistent with that purpose. Before installing or allowing the agent to use it, consider: - The SKILL.md instructs the agent to install packages (pip, apt/brew) and clone tools from GitHub; these will download and run third-party code. If you want to avoid network installs, run them manually in a controlled environment or sandbox first. - The skill contains many executable code snippets that may read local files (e.g., ciphertexts) and run heavy math (Sage, LLL, BKZ). Run the skill in an isolated environment to avoid accidental access to sensitive files or heavy resource usage. - There is a minor metadata mismatch: SKILL.md sets metadata.user-invocable to "false" while the registry lists the skill as user-invocable; decide whether you want to allow agent-autonomous use or restrict invocation to manual control. - This content is dual-use: it documents techniques for breaking cryptography (normal for CTF/educational use). Ensure use complies with laws and your policies. If you accept those trade-offs, the skill appears coherent and aligns with its description.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ehz7yedvktsqxw75jypv9r183wgad

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments