red-run-ctf
Warn
Audited by Gen Agent Trust Hub on Apr 2, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The orchestrator dynamically generates and modifies shell scripts (e.g., hosts-update.sh and clock-sync.sh) by copying local templates and applying transformations via sed and other bash utilities.
- [COMMAND_EXECUTION]: Instructs the agent to prompt the user to execute generated scripts using sudo, which introduces a risk of privilege escalation if the scripts are manipulated or contain errors.
- [COMMAND_EXECUTION]: Manages a complex team lifecycle including process spawning (TeamCreate, Agent tool), file system operations (Write/Edit tools), and inter-agent communication via SendMessage.
- [PROMPT_INJECTION]: Vulnerable to indirect prompt injection as it ingests findings from external sources (e.g., service banners, target source code, and teammate reports) which are used to influence high-privilege logic and task assignments.
- Ingestion points: Teammate messages, state management database events, and raw source code files ingested during assessments.
- Boundary markers: Encourages the use of informational context rather than direct instructions when passing discovery findings to teammates, but lacks robust technical enforcement.
- Capability inventory: Possesses capabilities to spawn persistent agents, write system configuration files, and generate shell commands for user execution.
- Sanitization: Lacks specific sanitization or validation logic for data retrieved from target systems before it is interpolated into task contexts or control logic.
Audit Metadata