ctf-agent

Enforce artifact-contract, presence, dependency, freshness, and cross-reference correctness for the artifact graph.

Reuse prior work only when hashes, dependencies, and artifact semantics still support it.

Normalize remote configuration and connection hints into machine-readable, ambiguity-aware remote artifacts.

Run a bounded, evidence-heavy cribdrag workflow for suspected keystream reuse and XOR-style leakage.

Drive decode-first problems through explicit candidate generation, convergence tests, and branch stop conditions.

Map mixed decode-plus-crypto chains into explicit stages, transitions, and evidence-backed branch routes.

Build explicit vulnerability hypotheses with preconditions, discriminators, costs, scores, and attack-family context.

Inventory the challenge, classify the route, map the attack surface, and create the first durable state snapshot.

Collect bounded, reproducible remote transcripts and characterize oracle behavior without wasting or poisoning the service.

Extract, normalize, and provenance-track cryptographic and representational parameters from all available evidence.

Retrieve attack-family references, precondition checklists, and solver templates without letting retrieval replace local proof.

Use online research surgically when a narrow unknown blocks a real branch, then convert that research into evidence-bound workflow changes.

Perform adversarial review as a manager-invoked skill. Challenge optimistic narratives, find stale dependencies, demand discriminative tests, and emit durable skeptical review artifacts before hypotheses, validation claims, or solver readiness are accepted.

Build a deterministic reproducer only after verification, and prove that it works repeatably under recorded conditions.

Deepen oracle-family reasoning for padding, format, timing, and protocol-partition leaks.

Deepen RSA-family reasoning across textbook misuse, modulus failures, prime reuse, exponent mistakes, and signature confusion.

Validate hypotheses with focused scripts, explicit evidence artifacts, feasibility checks, and skeptical-review-ready proof trails.

Produce a concise but evidence-linked writeup that matches the validated path and preserves rejected alternatives.

Handle hardened or packed APKs by recovering a usable static corpus with evidence-backed static analysis and the smallest justified runtime extraction.

Reverse an APK comprehensively with artifact-rich static analysis first, then minimal dynamic validation only when static evidence requires it.

Solve a custom VM by recovering an evidence-backed VM specification, extracting bytecode, implementing a safe emulator, and validating the resulting output.

Reverse shellcode or staged raw code safely through bounded emulation and artifact-backed extraction.

Prepare authorization bypass test variants for a single hypothesis into artifacts/out/attacks/<HID>.json.

Prepare deserialization test plan templates (format constraints only, no gadget payloads) for a single hypothesis into artifacts/out/attacks/<HID>.json.

Prepare IDOR test variants (baseline vs modified object ids) for a single hypothesis into artifacts/out/attacks/<HID>.json.

Prepare mass-assignment test variants (add sensitive fields placeholders) for a single hypothesis into artifacts/out/attacks/<HID>.json.

Prepare a generic attack recipe for a hypothesis that does not fit the more specific families, writing artifacts/out/attacks/<HID>.json.

Prepare sensitive-data exposure verification variants for a single hypothesis into artifacts/out/attacks/<HID>.json.

Prepare SQL injection test plan templates (benign structural placeholders only) for a single hypothesis into artifacts/out/attacks/<HID>.json.

Prepare SSRF test variants (safe placeholder destinations only) for a single hypothesis into artifacts/out/attacks/<HID>.json.

Prepare XSS test variants (safe placeholders only) for a single hypothesis into artifacts/out/attacks/<HID>.json.

Analyze stateful workflows, invariants, authorization boundaries, and sequence assumptions; write artifacts/out/business_logic.json and merged evidence.

Capture browser-dependent verification observations for client-rendered, DOM-based, or hydration-dependent hypotheses.

Normalize assessment context, runtime mode, auth material, and request shaping into artifacts/out/context.json.

Trace bounded attacker-controlled source-to-transform-to-sink flows and write artifacts/out/dataflow_index.json plus merged evidence.

Convert merged evidence into ranked, testable vulnerability hypotheses and write artifacts/out/hypotheses.json.

Prepare and record safe out-of-band callback infrastructure observations for hypotheses that require callback evidence.

Assemble the final findings set, rejected or inconclusive appendix, and traceability index into artifacts/report/findings.json and artifacts/report/traceability.json.

Perform tightly scoped version-locked research for a blocked hypothesis and write artifacts/out/research/<HID>.json.

Enumerate concrete or approximate route shapes from framework routing code and write artifacts/out/route_map.json plus merged route evidence.