Announcing Beacon: Self-improving memory for coding agents
BeaconIntel
2.9K
← All skills
Skill

competition-prompt-injection

skill:zhaoxuya520/reverse-skill#competition-prompt-injection

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for prompt-injection, retrieval poisoning, memory contamination, planner drift, MCP or tool-boundary abuse, and agent exfiltration challenges. Use when the user asks to analyze prompt injection, retrieval poisoning, memory contamination, planner drift, tool-argument corruption, or secret exposure caused by an agent chain. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

SkillsMP
Verdict
Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 22:28 UTC at cab634b

Dispute security verdict

If you believe this verdict is incorrect, submit a dispute and we'll review it.

1
findings
medium
highest severity
1
threat classes
632
files scanned
38/38
checks satisfied
0
package advisories

Why this verdict

  • suspicious: finding skill:CTF-Sandbox-Orchestrator/competition-prompt-injection:CTF-Sandbox-Orchestrator/competition-prompt-injection/SKILL.md:12:HIJACK

Security findings 1

Agent hijacking

mediumContextual risklow confidence

The skill undeclaredly instructs the agent to reply in Simplified Chinese unless the user explicitly requests English, conditioning agent output behavior in a way its declared CTF prompt-injection analysis purpose does not require; it is plainly visible (not concealed) and yields to explicit user requests, so it is unexplained residue at contextual_risk.

CTF-Sandbox-Orchestrator/competition-prompt-injection/SKILL.md:12
Reply in Simplified Chinese unless the user explicitly requests English.
vector:instruction
Counter-argument considered

Kill attempt fails: the line is plainly a direct agent instruction, but no carve-out applies (the declared description covers only prompt-injection CTF analysis workflow, not output-language policy) and no mitigation neutralizes it, since the 'unless the user explicitly requests English' clause merely bounds the default conditioning rather than removing the undeclared behavior-shaping of agent replies. The quote means exactly what the claim says, so the finding stands at its stated contextual_risk severity.

Coverage gaps 37

Parts of the artifact the static analysis could not fully examine.

context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/CommandLineArgumentException.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/CommandLineOption.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/CommandLineParser$AfterOptions.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/CommandLineParser$BeforeFirstSubCommand.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/CommandLineParser$KnownOptionParserState.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/CommandLineParser$MissingOptionArgState.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/CommandLineParser$OptionAwareParserState.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/CommandLineParser$OptionParserState.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/CommandLineParser$OptionString.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/CommandLineParser$ParserState.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/CommandLineParser$UnknownOptionParserState.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/CommandLineParser.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/ParsedCommandLine.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/cli/ParsedCommandLineOption.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/internal/file/PathTraversalChecker.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/internal/file/locking/ExclusiveFileAccessManager.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/util/internal/WrapperDistributionUrlConverter.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/BootstrapMainStarter$1.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/Download$DefaultDownloadProgressListener.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/Download$ProxyAuthenticator.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/Download.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/GradleUserHomeLookup.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/GradleWrapperMain.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/Install$1.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/Install$InstallCheck.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/Install.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/Logger.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/PathAssembler.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/SystemPropertiesHandler.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/WrapperConfiguration.class
context:unanalyzable_binary java_class content is only byte-scanned
burp-mcp-full/gradle/wrapper/gradle-wrapper.jar!/org/gradle/wrapper/WrapperExecutor.class
context:unanalyzable_binary binary content is only byte-scanned
skills/pentest-tools/src-hunter/references/payloader/by-category/web/文件漏洞.md
context:unanalyzable_binary binary content is only byte-scanned
skills/pentest-tools/src-hunter/references/payloader/by-category/web/请求走私.md
context:unanalyzable_binary binary content is only byte-scanned
skills/pentest-tools/src-hunter/references/payloader/waf-bypass.md
context:unanalyzable_binary binary content is only byte-scanned
skills/pentest-tools/src-hunter/references/playbooks/file-upload.md
context:unanalyzable_binary binary content is only byte-scanned
skills/pentest-tools/src-hunter/references/playbooks/http-smuggling.md
context:frontmatter_unparseable while parsing a block mapping
skills/field-journal/2026-05-16_pentest-personalblog-fun-mass-assignment.md