ClawHub
Back to skill

Security audit

Ctf Reverse

Security checks for vulnerabilities and agentic risk

Overview

This CTF reverse-engineering skill is transparent about its purpose, but it includes risky bypass, upload, and remote-install instructions that need careful review before use.

Use this only in an isolated lab or CTF environment and only against targets you own or are explicitly authorized to analyze. Pin and verify tool installs, avoid curl-to-bash commands, do not run setup commands as root unless necessary, and do not upload proprietary or confidential binaries to external services without informed approval.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
tools-advanced.md:551
Finding

Unverified Remote Script Download and Immediate Shell Execution

Content
View full analysis

Vulnerability Details

File Location: tools-advanced.md, lines 551-552
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash
# https://github.com/hugsy/gef
bash -c "$(curl -fsSL https://gef.blah.cat/sh)"

Technical Analysis

The documented command retrieves mutable content from an external endpoint and immediately executes it with Bash. There is no version pinning, cryptographic checksum verification, signature validation, local inspection step, or isolation boundary.

Although GEF is relevant to reverse-engineering work, executing the latest response from a remote server is not the minimum access necessary to install it. The executed payload receives the permissions of the invoking user and can perform arbitrary operations available to that account. The GitHub comment does not protect the command because the executable content is obtained from a separate domain.

Attack Path

  1. An attacker compromises the remote server, its deployment pipeline, domain, or another component of the delivery chain.
  2. The attacker replaces the installation response with a malicious shell script.
  3. A user or Agent follows the Skill documentation and runs the command.
  4. curl retrieves the attacker-controlled response.
  5. Bash executes the response immediately without verification.
  6. The payload accesses or alters files, credentials, development tools, debugger configuration, or other resources available to the invoking account.

Impact Assessment

Successful exploitation provides arbitrary code execution with the privileges of the user running the installation command. Potential effects include theft of user-accessible credentials and source files, modification of shell or debugger configuration, installation of trojanized debugging hooks, and compromise of subsequently analyzed binaries. Administrative impact is possible if the command is unnecessarily r ...[truncated 27 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the download-and-execute command.
  • Obtain GEF from its official repository using a pinned release tag or immutable commit hash.
  • Download the artifact without executing it, then verify a maintainer-published signature or SHA-256 checksum.
  • Require inspection of installation scripts before execution.
  • Run installation inside a disposable container or restricted virtual environment as an unprivileged user.
  • Document the exact verified version and expected digest.
  • Avoid instructing an Agent to perform installation automatically without explicit user approval.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:19
Finding

Unpinned Third-Party Packages and Source Builds Create Supply-Chain Exposure

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19-21
Vulnerability Type: Insecure dependency installation
Risk Level: Medium

Vulnerable Code:

bash
pip install frida-tools angr qiling uncompyle6 capstone lief z3-solver
# For Python 3.9+ bytecode: build pycdc from source
git clone https://github.com/zrax/pycdc && cd pycdc && cmake . && make

Related unpinned installation instructions also occur at SKILL.md:26-40, tools-advanced.md:387-388, tools-advanced.md:537-538, tools-dynamic.md:48, tools-dynamic.md:226, tools-dynamic.md:502-504, languages-compiled.md:257, languages-compiled.md:317, and languages-platforms.md:276.

Technical Analysis

The commands install packages from mutable package indexes and clone the current default branch of a third-party repository. They do not specify exact versions, immutable commit hashes, dependency hashes, or signature checks. Building the repository executes its current build configuration, while package installation may execute package build hooks and other dependency-controlled code.

The tools are relevant to the declared reverse-engineering functionality, but installing unrestricted latest versions is broader than necessary. The same functionality can be provided through pinned and verified dependencies in an isolated environment.

The related pwndbg instruction is particularly sensitive because it clones a mutable branch and runs ./setup.sh, allowing repository content and transitive dependencies to execute with the invoking user's permissions.

Attack Path

  1. An attacker compromises a package publisher, maintainer account, source repository, release process, or transitive dependency.
  2. The attacker publishes a malicious package version or modifies the repository's default branch.
  3. A user or Agent runs the unpinned installation instructions.
  4. The package manager selects the malicious current ve ...[truncated 850 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin every package to a reviewed exact version.
  • Use hash-locked dependency files, such as requirements.txt with --require-hashes, where supported.
  • Pin Git dependencies to immutable commit hashes rather than default branches.
  • Verify release signatures or maintainer-published checksums before building.
  • Review setup and build scripts before executing them.
  • Install Python packages in a dedicated virtual environment and avoid global npm installation.
  • Prefer a reproducible, non-root container image containing preverified tool versions.
  • Separate optional tools from prerequisites and install only the components required for the current analysis.
  • Require explicit user approval before modifying the host environment.

T09 · Insecure Skill Coding Practices

Warning
Location
tools.md:514
Finding

Analyzed Binaries May Be Disclosed to an External Decompilation Service

Content
View full analysis

Vulnerability Details

File Location: tools.md, lines 514-516
Vulnerability Type: Unprotected external transmission of analyzed files
Risk Level: Medium

Vulnerable Code:

bash
# Upload via web interface: https://dogbolt.org/
# Or use the API:
curl -F "file=@binary" https://dogbolt.org/api/binaries/

Technical Analysis

This command transmits the complete analyzed binary to a third-party service. The documentation does not require informed user consent, a confidentiality review, authorization from the binary owner, or confirmation that the service's retention and processing terms are acceptable.

The network transfer is explicit and supports decompiler comparison, so it is not covert exfiltration. Nevertheless, binaries may contain proprietary code, embedded credentials, private challenge material, customer information, or unpublished vulnerabilities. Local decompilers listed elsewhere in the Skill can provide the core reverse-engineering functionality without disclosing the target externally.

Attack Path

  1. A user supplies a confidential, proprietary, or otherwise restricted binary for local analysis.
  2. The Agent follows the Dogbolt comparison instructions without asking for upload authorization.
  3. curl submits the entire binary to dogbolt.org.
  4. The external service receives and processes the file.
  5. The file becomes subject to third-party access controls, logging, retention, security, and legal policies.
  6. Confidentiality is lost if the service, an operator, a downstream processor, or an attacker with access to the service obtains the uploaded material.

Impact Assessment

The direct technical impact is unauthorized disclosure of the complete target binary. The scope includes all code, resources, symbols, strings, certificates, embedded keys, and other data stored in that file. Secondary consequences may include intellectual-property loss, exposure of vulnerabilities or ...[truncated 212 chars]

Remediation
View remediation

Remediation Suggestions

  • Make local decompilation the default workflow.
  • Require explicit, informed user authorization before uploading any file.
  • Display a clear warning that the complete binary will leave the local environment.
  • Prohibit uploads of proprietary, confidential, regulated, or third-party-owned binaries without documented authorization.
  • Require review of the service's retention, privacy, and processing terms.
  • Strip unnecessary symbols and sensitive resources only when doing so is authorized and does not undermine the analysis.
  • Where external comparison is necessary, use an organization-approved private deployment or controlled analysis service.
  • Add an Agent rule that network uploads must never occur automatically.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (69)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md
- [languages-platforms.md](languages-platforms.md) - Platform/framework-specific: Roblox place file analysis, Godot game asset extraction, Rust serde_json schem

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

md
- [languages-platforms.md](languages-platforms.md) - Platform/framework-specific: Roblox place file analysis, Godot game asset extraction, Rust serde_json schem

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 269)May include surrounding context.

md
- [languages-platforms.md](languages-platforms.md) - Platform/framework-specific: Roblox place file analysis, Godot game asset extraction, Rust serde_json schem

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.

md
- [languages-platforms.md](languages-platforms.md) - Platform/framework-specific: Roblox place file analysis, Godot game asset extraction, Rust serde_json schem

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 333)May include surrounding context.

md
- [languages-platforms.md](languages-platforms.md) - Platform/framework-specific: Roblox place file analysis, Godot game asset extraction, Rust serde_json schem

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 357)May include surrounding context.

md
- [languages-platforms.md](languages-platforms.md) - Platform/framework-specific: Roblox place file analysis, Godot game asset extraction, Rust serde_json schem

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 361)May include surrounding context.

md
- [languages-platforms.md](languages-platforms.md) - Platform/framework-specific: Roblox place file analysis, Godot game asset extraction, Rust serde_json schem

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 413)May include surrounding context.

md
- [languages-platforms.md](languages-platforms.md) - Platform/framework-specific: Roblox place file analysis, Godot game asset extraction, Rust serde_json schem

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 505)May include surrounding context.

md
- [languages-platforms.md](languages-platforms.md) - Platform/framework-specific: Roblox place file analysis, Godot game asset extraction, Rust serde_json schem

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · anti-analysis.md (reported line 60)May include surrounding context.

i-Debug (Real-World Pattern)](#layered-anti-debug-real-world-pattern)

Linux Anti-Debug (Advanced)

ptrace-Based

Self-ptrace (most common):

c
if (ptrace(PTRACE_TRACEME, 0, 0, 0) == -1) exit(1); // Already traced = debugger attached

Bypasses:

bash
# 1. LD_PRELOAD (see patterns.md for full hook)
LD_PRELOAD=./hook.so ./binary

# 2. Patch with pwntools
python3 -c "
from pwn import *
elf = ELF('./binary', checksec=False)
elf.asm(elf.symbols.ptrace, 'xor eax, eax; ret')
elf.save('patched')
"

# 3. GDB: catch the syscall
gdb ./binary
(gdb) catch syscall ptrace
(gdb) run
# When it stops at ptrace:
(gdb) set $rax = 0
(gdb) continue

# 4. Kernel config (requires root)
echo 0 > /proc/sys/kernel/yama/ptrace_scope

Double-ptrace pattern:

c
// Fork child to ptrace parent — blocks all other debuggers
pid_t child = fork();
if (child == 0) {
    ptrace(PTRACE_ATTACH, getppid(), 0, 0);

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High
Category
YARA Match
Confidence
93% confidence
Finding

The pwntools example provides concrete, ready-to-run binary patching steps that alter program behavior to disable anti-debugging (ptrace) checks. Although appropriate to a CTF reverse-engineering context, this is still dual-use offensive tradecraft that can be repurposed to tamper with protections in third-party binaries or evade analysis controls.

Content

Scanner excerpt · anti-analysis.md (reported line 64)May include surrounding context.

Linux Anti-Debug (Advanced)

ptrace-Based

Self-ptrace (most common):

c
if (ptrace(PTRACE_TRACEME, 0, 0, 0) == -1) exit(1); // Already traced = debugger attached

Bypasses:

bash
# 1. LD_PRELOAD (see patterns.md for full hook)
LD_PRELOAD=./hook.so ./binary

# 2. Patch with pwntools
python3 -c "
from pwn import *
elf = ELF('./binary', checksec=False)
elf.asm(elf.symbols.ptrace, 'xor eax, eax; ret')
elf.save('patched')
"

# 3. GDB: catch the syscall
gdb ./binary
(gdb) catch syscall ptrace
(gdb) run
# When it stops at ptrace:
(gdb) set $rax = 0
(gdb) continue

# 4. Kernel config (requires root)
echo 0 > /proc/sys/kernel/yama/ptrace_scope

Double-ptrace pattern:

c
// Fork child to ptrace parent — blocks all other debuggers
pid_t child = fork();
if (child == 0) {
    ptrace(PTRACE_ATTACH, getppid(), 0, 0);
    // Child sits in waitpid loop, keeping parent traced
} else {

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · anti-analysis.md (reported line 653)May include surrounding context.

md
if mnem not in ('jmp', 'je', 'jne', 'call', 'ret'):
            instructions.append((ea, mnem, idc.print_operands(ea)))
        ea = idc.next_head(ea)
    return instructions

transforms = trace_transforms(0x401000, 0x401200)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

This section goes beyond defensive reverse-engineering guidance and provides operational instructions for modifying a Go-compiled C2 client to impersonate a different client identity, register to a live server, enumerate other clients, and download their files. That is actionable post-exploitation tradecraft enabling unauthorized access to third-party data, not merely analysis of a binary in isolation.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The text presents unauthorized interaction with a C2 service as a normal workflow, without any warning, scoping constraint, or consent boundary. Because it normalizes patching credentials/identifiers and accessing other clients' files, it materially lowers the barrier to misuse against real infrastructure.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

These lines explicitly direct the user to enumerate other clients and download their files from C2 storage, which is an instruction to obtain data belonging to others without authorization. In the context of a generally powerful reverse-engineering skill, this materially increases abuse potential because it pairs technical reconnaissance with concrete collection objectives.

Content

No source excerpt is available for this finding.

Ssd 4

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The narrative is a step-by-step procedure for unauthorized registration to a command-and-control environment and subsequent collection of other victims' files. Detailed procedural guidance of this kind is directly usable for intrusion or abuse and exceeds what is appropriate for a reverse-engineering skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

This section provides actionable instructions for bypassing application-side validation and directly invoking Firebase Cloud Functions with attacker-controlled parameters. Even in a CTF context, the technique maps directly to real-world abuse of backend actions, account-linked operations, and external services, increasing the risk of unauthorized transactions or data manipulation.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
- [VM Sequential Key-Chain Brute-Force (Midnight Flag 2026)](#vm-sequential-key-chain-brute-force-midnight-flag-2026)
- [Burrows-Wheeler Transform Inversion without Terminator (ASIS CTF Finals 2016)](#burrows-wheeler-transform-inversion-without-terminator-asis-ctf-finals-2016)
- [OpenType Font Ligature Exploitation for Hidden Messages (Hack The Vote 2016)](#opentype-font-ligature-exploitation-for-hidden-messages-hack-the-vote-2016)
- [GLSL Shader VM with Self-Modifying Code (ApoorvCTF 2026)](#glsl-shader-vm-with-self-modifying-code-apoorvctf-2026)
- [Instruction Counter as Cryptographic State (MetaCTF Flash 2026)](#instruction-counter-as-cryptographic-state-metactf-flash-2026)
- [Thread Race Condition with Signed Integer Overflow (Codegate 2017)](#thread-race-condition-with-signed-integer-overflow-codegate-2017)
- [ESP32/Xtensa Firmware Reversing with ROM Symbol Map (Insomni'hack 2017)](#esp32xtensa-firmware-reversing-with-rom-symbol-map-insomnihack-2017)

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
- [VM Sequential Key-Chain Brute-Force (Midnight Flag 2026)](#vm-sequential-key-chain-brute-force-midnight-flag-2026)
- [Burrows-Wheeler Transform Inversion without Terminator (ASIS CTF Finals 2016)](#burrows-wheeler-transform-inversion-without-terminator-asis-ctf-finals-2016)
- [OpenType Font Ligature Exploitation for Hidden Messages (Hack The Vote 2016)](#opentype-font-ligature-exploitation-for-hidden-messages-hack-the-vote-2016)
- [GLSL Shader VM with Self-Modifying Code (ApoorvCTF 2026)](#glsl-shader-vm-with-self-modifying-code-apoorvctf-2026)
- [Instruction Counter as Cryptographic State (MetaCTF Flash 2026)](#instruction-counter-as-cryptographic-state-metactf-flash-2026)
- [Thread Race Condition with Signed Integer Overflow (Codegate 2017)](#thread-race-condition-with-signed-integer-overflow-codegate-2017)
- [ESP32/Xtensa Firmware Reversing with ROM Symbol Map (Insomni'hack 2017)](#esp32xtensa-firmware-reversing-with-rom-symbol-map-insomnihack-2017)

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 341)May include surrounding context.

md
- [VM Sequential Key-Chain Brute-Force (Midnight Flag 2026)](#vm-sequential-key-chain-brute-force-midnight-flag-2026)
- [Burrows-Wheeler Transform Inversion without Terminator (ASIS CTF Finals 2016)](#burrows-wheeler-transform-inversion-without-terminator-asis-ctf-finals-2016)
- [OpenType Font Ligature Exploitation for Hidden Messages (Hack The Vote 2016)](#opentype-font-ligature-exploitation-for-hidden-messages-hack-the-vote-2016)
- [GLSL Shader VM with Self-Modifying Code (ApoorvCTF 2026)](#glsl-shader-vm-with-self-modifying-code-apoorvctf-2026)
- [Instruction Counter as Cryptographic State (MetaCTF Flash 2026)](#instruction-counter-as-cryptographic-state-metactf-flash-2026)
- [Thread Race Condition with Signed Integer Overflow (Codegate 2017)](#thread-race-condition-with-signed-integer-overflow-codegate-2017)
- [ESP32/Xtensa Firmware Reversing with ROM Symbol Map (Insomni'hack 2017)](#esp32xtensa-firmware-reversing-with-rom-symbol-map-insomnihack-2017)

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · patterns-ctf-2.md (reported line 397)May include surrounding context.

md
- [VM Sequential Key-Chain Brute-Force (Midnight Flag 2026)](#vm-sequential-key-chain-brute-force-midnight-flag-2026)
- [Burrows-Wheeler Transform Inversion without Terminator (ASIS CTF Finals 2016)](#burrows-wheeler-transform-inversion-without-terminator-asis-ctf-finals-2016)
- [OpenType Font Ligature Exploitation for Hidden Messages (Hack The Vote 2016)](#opentype-font-ligature-exploitation-for-hidden-messages-hack-the-vote-2016)
- [GLSL Shader VM with Self-Modifying Code (ApoorvCTF 2026)](#glsl-shader-vm-with-self-modifying-code-apoorvctf-2026)
- [Instruction Counter as Cryptographic State (MetaCTF Flash 2026)](#instruction-counter-as-cryptographic-state-metactf-flash-2026)
- [Thread Race Condition with Signed Integer Overflow (Codegate 2017)](#thread-race-condition-with-signed-integer-overflow-codegate-2017)
- [ESP32/Xtensa Firmware Reversing with ROM Symbol Map (Insomni'hack 2017)](#esp32xtensa-firmware-reversing-with-rom-symbol-map-insomnihack-2017)

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · patterns-ctf-3.md (reported line 13)May include surrounding context.

md
- [VM Sequential Key-Chain Brute-Force (Midnight Flag 2026)](#vm-sequential-key-chain-brute-force-midnight-flag-2026)
- [Burrows-Wheeler Transform Inversion without Terminator (ASIS CTF Finals 2016)](#burrows-wheeler-transform-inversion-without-terminator-asis-ctf-finals-2016)
- [OpenType Font Ligature Exploitation for Hidden Messages (Hack The Vote 2016)](#opentype-font-ligature-exploitation-for-hidden-messages-hack-the-vote-2016)
- [GLSL Shader VM with Self-Modifying Code (ApoorvCTF 2026)](#glsl-shader-vm-with-self-modifying-code-apoorvctf-2026)
- [Instruction Counter as Cryptographic State (MetaCTF Flash 2026)](#instruction-counter-as-cryptographic-state-metactf-flash-2026)
- [Thread Race Condition with Signed Integer Overflow (Codegate 2017)](#thread-race-condition-with-signed-integer-overflow-codegate-2017)
- [ESP32/Xtensa Firmware Reversing with ROM Symbol Map (Insomni'hack 2017)](#esp32xtensa-firmware-reversing-with-rom-symbol-map-insomnihack-2017)

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · patterns-ctf.md (reported line 636)May include surrounding context.

md
- [VM Sequential Key-Chain Brute-Force (Midnight Flag 2026)](#vm-sequential-key-chain-brute-force-midnight-flag-2026)
- [Burrows-Wheeler Transform Inversion without Terminator (ASIS CTF Finals 2016)](#burrows-wheeler-transform-inversion-without-terminator-asis-ctf-finals-2016)
- [OpenType Font Ligature Exploitation for Hidden Messages (Hack The Vote 2016)](#opentype-font-ligature-exploitation-for-hidden-messages-hack-the-vote-2016)
- [GLSL Shader VM with Self-Modifying Code (ApoorvCTF 2026)](#glsl-shader-vm-with-self-modifying-code-apoorvctf-2026)
- [Instruction Counter as Cryptographic State (MetaCTF Flash 2026)](#instruction-counter-as-cryptographic-state-metactf-flash-2026)
- [Thread Race Condition with Signed Integer Overflow (Codegate 2017)](#thread-race-condition-with-signed-integer-overflow-codegate-2017)
- [ESP32/Xtensa Firmware Reversing with ROM Symbol Map (Insomni'hack 2017)](#esp32xtensa-firmware-reversing-with-rom-symbol-map-insomnihack-2017)

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · patterns.md (reported line 18)May include surrounding context.

md
- [VM Sequential Key-Chain Brute-Force (Midnight Flag 2026)](#vm-sequential-key-chain-brute-force-midnight-flag-2026)
- [Burrows-Wheeler Transform Inversion without Terminator (ASIS CTF Finals 2016)](#burrows-wheeler-transform-inversion-without-terminator-asis-ctf-finals-2016)
- [OpenType Font Ligature Exploitation for Hidden Messages (Hack The Vote 2016)](#opentype-font-ligature-exploitation-for-hidden-messages-hack-the-vote-2016)
- [GLSL Shader VM with Self-Modifying Code (ApoorvCTF 2026)](#glsl-shader-vm-with-self-modifying-code-apoorvctf-2026)
- [Instruction Counter as Cryptographic State (MetaCTF Flash 2026)](#instruction-counter-as-cryptographic-state-metactf-flash-2026)
- [Thread Race Condition with Signed Integer Overflow (Codegate 2017)](#thread-race-condition-with-signed-integer-overflow-codegate-2017)
- [ESP32/Xtensa Firmware Reversing with ROM Symbol Map (Insomni'hack 2017)](#esp32xtensa-firmware-reversing-with-rom-symbol-map-insomnihack-2017)

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 339)May include surrounding context.

md
- [VM Sequential Key-Chain Brute-Force (Midnight Flag 2026)](#vm-sequential-key-chain-brute-force-midnight-flag-2026)
- [Burrows-Wheeler Transform Inversion without Terminator (ASIS CTF Finals 2016)](#burrows-wheeler-transform-inversion-without-terminator-asis-ctf-finals-2016)
- [OpenType Font Ligature Exploitation for Hidden Messages (Hack The Vote 2016)](#opentype-font-ligature-exploitation-for-hidden-messages-hack-the-vote-2016)
- [GLSL Shader VM with Self-Modifying Code (ApoorvCTF 2026)](#glsl-shader-vm-with-self-modifying-code-apoorvctf-2026)
- [Instruction Counter as Cryptographic State (MetaCTF Flash 2026)](#instruction-counter-as-cryptographic-state-metactf-flash-2026)
- [Thread Race Condition with Signed Integer Overflow (Codegate 2017)](#thread-race-condition-with-signed-integer-overflow-codegate-2017)
- [ESP32/Xtensa Firmware Reversing with ROM Symbol Map (Insomni'hack 2017)](#esp32xtensa-firmware-reversing-with-rom-symbol-map-insomnihack-2017)