ClawHub
Back to skill

Security audit

rsa-ctf-skills

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed RSA CTF-solving skill whose main caveat is that its FactorDB mode sends the supplied RSA modulus to factordb.com.

Use this skill for CTF or intentionally shared RSA challenge data. Avoid FactorDB mode for private keys, embargoed challenge material, investigation targets, or real production RSA moduli unless you are comfortable sending the modulus to factordb.com. Expect Chinese-language help and output.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: rsa-ctf-skills
description: 集成11种RSA攻击算法的CTF解题工具，支持factordb在线分解；当用户需要解密RSA密文、分解n模数、分析CTF密码学题目或实现特定RSA攻击场景时使用
dependency:
  python:
    - gmpy2>=2.1.0
    - sympy>=1.10.0
    - requests>=2.28.0
---

# RSA CTF解题工具

## 任务目标
- 本工具用于：CTF比赛中的RSA密码学题目求解
- 能力包含：11种常见RSA攻击算法、多种输入方式、统一输出格式
- 触发条件：用户需要解密RSA密文、分解大整数、或针对特定RSA漏洞进行攻击时

## 前置准备
-

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md
3. **执行攻击脚本**：调用 `scripts/rsa_solver.py` 执行对应攻击

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
3. **执行攻击脚本**：调用 `scripts/rsa_solver.py` 执行对应攻击

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
3. **执行攻击脚本**：调用 `scripts/rsa_solver.py` 执行对应攻击

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md
3. **执行攻击脚本**：调用 `scripts/rsa_solver.py` 执行对应攻击

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
3. **执行攻击脚本**：调用 `scripts/rsa_solver.py` 执行对应攻击

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
3. **执行攻击脚本**：调用 `scripts/rsa_solver.py` 执行对应攻击

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill declares a Python dependency on requests and explicitly documents use of the online FactorDB service, but the manifest does not declare any tool scope, permissions, or allowed network access. That creates an undeclared network capability: users and orchestrators may invoke the skill without realizing it can transmit RSA moduli or challenge data to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description advertises FactorDB-backed factorization but does not clearly warn that the factor attack may send user-supplied RSA parameters to a third-party online service. In a security or CTF context, those values may still be sensitive or embargoed, so silent external submission creates a privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The entire markdown guide is written in Chinese and does not indicate that other languages are supported or that the user can choose a preferred language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The function sends the user-supplied RSA modulus n to factordb.com over the network without any user-facing notice, consent, or opt-in. In a CTF context this is often harmless, but in broader use an RSA modulus may belong to a real system or investigation target, and silently disclosing it to a third party can leak sensitive challenge material, operational data, or attribution-relevant metadata.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The entire skill description and instructions are written in Chinese, and there is no indication that language choice is optional or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The natural-language strings in the module docstring and CLI/help text are written in Chinese, and the runtime messages also assume Chinese output. Under the language/locale policy, forcing a specific language without user opt-in is a policy concern unless the tool clearly documents a justified locale constraint or offers a language choice.

Content

No source excerpt is available for this finding.