null-zone-treasure-scan

Scans social platform posts incrementally to decode hidden clues and submit CTF flags.

545|48|Updated Nov 10, 2025
One-click install
npx skills add https://github.com/yhy0/CHYing-agent --skill null-zone-treasure-scan
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: null-zone-treasure-scan
Source: https://github.com/yhy0/CHYing-agent/tree/main/null-zone/skills/null-zone-treasure-scan
Command: npx skills add https://github.com/yhy0/CHYing-agent --skill null-zone-treasure-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

In timed CTF treasure-hunt challenges, flags are hidden inside a stream of social platform posts using encodings and word puzzles, and manual monitoring is too slow to win first-blood bonuses. This Skill automates recurring incremental scans, clue decoding, and immediate flag submission.

Core Features & Use Cases

  • Incremental Scheduled Scanning: Runs every 3 minutes during business hours, processes only new posts via last_post_id tracking, and throttles consecutive empty rounds to save API quota.
  • Multi-Method Clue Decoding: Detects and decodes flag patterns including Base64, Hex, ROT13, Caesar, URL encoding, binary, Unicode, and first/last/middle letter extraction puzzles.
  • Automatic Flag Submission with Format Variants: Immediately submits decoded answers, tries multiple capitalization and separator format variants, verifies success via leaderboard solve counts, and tracks pending clues for retry.
  • Use Case: During a CTF competition's social-platform treasure hunt, schedule this Skill to continuously monitor official bot posts and comments, decode a Base64-encoded flag the moment it appears, and submit it before competing teams.

Quick Start

Run the treasure scan now to check for new official posts, decode any hidden clues, and submit any discovered flags immediately.

Frequently Asked Questions about null-zone-treasure-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automatically find flags hidden in CTF challenge posts?

Run incremental scans that fetch only new posts since the last recorded post ID, then apply a decoding pipeline covering Base64, Hex, ROT13, Caesar, URL encoding, binary, and letter-extraction patterns. Submit any decoded flag immediately and verify via the leaderboard solve count.

How to decode Base64 or Caesar cipher clues in CTF challenges?

Match Base64 with the pattern [A-Za-z0-9+/=]{16} and decode it, then check the result for a flag prefix. For Caesar ciphers, brute-force all shifts from 1 to 25 and inspect each output for flag-like content.

What should I do when a decoded CTF answer is not in flag format?

Generate format variants automatically: try uppercase, lowercase, capitalized, underscore-joined, and hyphen-joined versions of the word inside flag{} braces. Verify each attempt against the leaderboard solve count and stop once it increments.

How do I avoid wasting API quota on repeated empty scans?

Track a consecutive empty scan counter in persistent state. After two consecutive rounds with no new posts, skip all further API calls for that round and exit early, resetting the counter whenever new content appears.

Why does flag submission fail even with the correct decoded word?

The expected flag format may differ in capitalization or separators from your decoded word. Record the failed attempt as a pending clue, and retry it later when other successful submissions reveal the correct format convention.