ctf-crypto

Pass

Audited by Gen Agent Trust Hub on Apr 22, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references and encourages the installation of several specialized third-party tools and libraries from non-standard sources, including RsaCtfTool, not_random (for Mersenne Twister state recovery), v8_rand_buster, and roca-detect. While these are established tools within the CTF community, they originate from individual GitHub repositories rather than official vendor registries.
  • [COMMAND_EXECUTION]: The instructions detail the execution of various command-line utilities and scripts, such as sage, python, hashpump, and padbuster. It involves generating and executing dynamic code to perform complex mathematical computations and cryptanalysis.
  • [PROMPT_INJECTION]: The skill is designed to process external cryptographic data (such as user-provided ciphertexts or modular parameters) through its scripts. It lacks explicit instructions for the agent to sanitize this input or use boundary markers, creating a surface for indirect prompt injection if the processed data contains malicious instructions targeting the LLM's behavior.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 22, 2026, 07:57 AM