ctf-source-audit

Load this Skill and point it at the challenge's source attachments. It traces untrusted input across trust boundaries, maps data flows toward flag storage, and records exploitation evidence for building a working exploit.

Trust boundary analysis identifies where user-controlled input enters privileged code paths, such as database queries, command execution, template rendering, or deserialization. These crossing points are the most likely exploitation targets in challenge source code.

No. The Skill explicitly saves data flow and exploitation evidence but does not submit flags directly. Flag submission is handled separately by the orchestrating agent after the exploit is validated.

This Skill is scoped to explicitly authorized CTF competition environments where organizers provide source code for analysis. Auditing systems without authorization is illegal and outside this Skill's intended use.

Static audit cannot confirm runtime behavior such as race conditions, environment-specific configurations, or remote service interactions. Findings should be validated with dynamic testing against the live challenge instance.