ctf-flag-verification
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill uses strong instructional language in the metadata and body (e.g., "必须立即", "不要直接提交", "任何时候看到 flag{ 字样都应触发此 skill") intended to prioritize this specific verification workflow over standard responses when potential flags are detected.
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves processing untrusted data (suspected flags) extracted from external environments like web pages, databases, or command outputs.
- Ingestion points: Processes data from SQL injection results, RCE outputs, and file reads as documented in
SKILL.md. - Boundary markers: The instructions do not specify the use of delimiters or specific ignore-instruction wrappers when feeding these untrusted inputs into the agent's context.
- Capability inventory: The skill uses Python for regex matching (
re.match), string length verification, and HTML unescaping (html.unescape). - Sanitization: Recommends a strict regex filter (
^flag\{[a-fA-F0-9_-]+\}$) which acts as a robust validation mechanism to ensure the input conforms to expected formats and does not contain malicious payloads.
Audit Metadata