Trace inputs to dangerous sinks in CTF challenge source code.
npx skills add https://github.com/wgpsec/AboutSecurity --skill ctf-source-audit
Please help me install this Agent Skill. Skill: ctf-source-audit Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/ctf/ctf-source-audit Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill ctf-source-audit
This Skill helps security researchers and CTF players quickly locate intentionally planted vulnerabilities in short challenge source code, reducing time spent on noisy manual review and improving hit rate on flag recovery.
Analyze the provided challenge source and list dangerous sinks, their potential sources, and a reproducible exploit to retrieve the flag.
High-intent search queries and answers about installing and using this skill.
To find vulnerabilities in CTF source code, identify dangerous sinks and trace user-controlled inputs to them. This approach detects intentionally seeded flaws across PHP, Python, Node.js, and Java, providing actionable findings, dataflow paths, and exploit payloads to retrieve flags.
Auditing leaked challenge artifacts like .git or .bak files involves classifying language paths and tracing dataflow to dangerous functions. This process highlights the minimal path to a flag by pinpointing vulnerable file locations and constructing reproducible exploit steps.
Yes, source code review can detect CTF flaws across multiple programming languages by using a dangerous-function catalog. It quickly classifies PHP, Python, Node.js, and Java code paths to focus auditing efforts and identify common CTF patterns and bypasses.
Sink-to-source dataflow tracing works by locating dangerous functions and mapping user-controlled inputs back to them. This mechanism guides investigators to identify bypasses and produce concise exploit steps, payload examples, and flag retrieval paths for CTF scoring.
A limitation of source auditing for CTF challenges is that it is applicable primarily to short repositories and leaked artifacts. It targets intentionally seeded flaws and exposed files, meaning it may not be effective for complex applications without clear source-to-sink dataflows.
ljagielloAutomate CTF challenge analysis by scanning files and connecting to services.
Q16GPerform black-box reconnaissance on a target URL to identify attack surfaces and extract a flag.
AnsteorraPerform static and dynamic security audits on the KMP application.
mahmutkaTrace untrusted input to dangerous sinks across Python, JavaScript, Go, and Java.
