ctf-crypto
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and encourages the installation of several specialized third-party tools and libraries from non-standard sources, including
RsaCtfTool,not_random(for Mersenne Twister state recovery),v8_rand_buster, androca-detect. While these are established tools within the CTF community, they originate from individual GitHub repositories rather than official vendor registries. - [COMMAND_EXECUTION]: The instructions detail the execution of various command-line utilities and scripts, such as
sage,python,hashpump, andpadbuster. It involves generating and executing dynamic code to perform complex mathematical computations and cryptanalysis. - [PROMPT_INJECTION]: The skill is designed to process external cryptographic data (such as user-provided ciphertexts or modular parameters) through its scripts. It lacks explicit instructions for the agent to sanitize this input or use boundary markers, creating a surface for indirect prompt injection if the processed data contains malicious instructions targeting the LLM's behavior.
Audit Metadata