CB ctf-pwn

Provides binary exploitation (pwn) techniques for CTF challenges. Use when exploiting buffer overflows, format strings, heap vulnerabilities (House of Orange, Spirit, Lore, Apple 2, Einherjar, tcache stashing unlink), race conditions, kernel bugs, ROP chains, ret2libc, ret2dlresolve, shellcode, GOT overwrite, use-after-free, seccomp bypass, FSOP, stack pivot, sandbox escape, Windows SEH overwrite, VirtualAlloc ROP, SeDebugPrivilege escalation, or Linux kernel exploitation (modprobe_path, tty_struct, userfaultfd, KASLR bypass, SLUB heap spray).

ClawHub Agent Skills author: gandli v1.0.0 MIT-0 16 files body ≈ 11 022 tokens Open the sourceclawhub.ai↗ analyzed 3 d ago

As a process B 73/100 · Nearly there — weak spots: when it triggers, execution cost, running it twice

Procedure Infrastructure Securitytype and topics are labelled automatically from the skill text

Runs in: OpenClaw Claude / Claude Code ChatGPT / Codex Gemini CLI Cursor GitHub Copilot / VS Code Qwen Code Kimi Code CLI Z.ai (GLM) DeepSeek (Deep Code) Mistral Vibe LangChain (deepagents) Goose OpenCode

JSON

Technical rating

61/100

safety, quality, tests

Safety 60%: 49
Quality 40%: 78
Run on models: none yet

Process rating

73/100

Nearly there

Progress reporting w 2: 0
When it triggers w 12: 20
Running it twice w 4: 30

the three weakest of ten parameters · all ten

What is at stake

Medium-severity findings: the skill is probably honest, but read what alarmed the scanner.

Broad scope medium severity

Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.

If you install

The skill asks for more than the task needs: broad tool access, credential environment variables, binaries. Every extra permission widens the damage from a mistake or a compromise.

For the author

Narrow allowed-tools and the variable list to the minimum; replace binaries with readable sources or scripts.

How to improve

The SKILL.md body is over 5,000 tokens: move reference detail into references/ and load it when needed.

For the model run — optional

Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.

Guard findings · 47

✓ No critical or high findings

Medium and low: 47

medium Broad scope meta-broad-allowed-tools SKILL.md:1

Broad tool permissions pre-approved: Bash
```
allowed-tools: Bash Read Write Edit Glob Grep Task WebFetch WebSearch
```
low Risky intent intent-offensive-security advanced-exploits-2.md:18

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
- [Full Exploitation Chain](#full-exploitation-chain)
```
low Risky intent intent-offensive-security advanced-exploits-2.md:59

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
**Exploitation chain:**
```
low Risky intent intent-offensive-security advanced-exploits-2.md:128

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
**Exploit chain:**
```
low Dangerous commands cmd-privilege advanced-exploits-2.md:313

Privilege escalation / world-writable permissions (documentation of a security skill)
```
encoded_setuid = rol(libc.sym.setuid ^ pointer_guard, 0x11)
```
security skill
low Dangerous commands cmd-privilege advanced-exploits-2.md:320

Privilege escalation / world-writable permissions (code comment; documentation of a security skill)
```
node1 += p64(encoded_setuid) # func = setuid(0)
```
commentsecurity skill
low Risky intent intent-offensive-security advanced-exploits-2.md:403

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
**Three-layer exploit chain:**
```
low Risky intent intent-offensive-security advanced-exploits-2.md:420

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
### Full Exploitation Chain
```
low Risky intent intent-offensive-security advanced-exploits-3.md:28

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
**Exploit chain:**
```
low Risky intent intent-offensive-security advanced-exploits-3.md:71

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
```
**Key insight:** 8-bit counters in read loops cause off-by-one when the buffer size equals the counter's range (64 → wraps after 64, writes byte 65). The 1-byte overflow into a size field creates a pr
```
quoted
low Risky intent intent-offensive-security advanced-exploits-3.md:115

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
**Exploit chain:**
```
low Risky intent intent-offensive-security advanced-exploits-3.md:156

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
**Exploit chain:**
```
low Risky intent intent-offensive-security advanced-exploits-4.md:343

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
# Exploit chain:
```
low Risky intent intent-offensive-security advanced-exploits-4.md:411

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
# Exploit chain:
```
low Risky intent intent-offensive-security advanced-exploits.md:85

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
**Exploit chain:**
```
low Risky intent intent-offensive-security advanced-exploits.md:261

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
**Exploit chain:**
```
low Risky intent intent-offensive-security advanced-exploits.md:332

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
**Exploit chain:**
```
low Risky intent intent-offensive-security advanced-exploits.md:467

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
**Exploit chain:**
```
low Dangerous commands cmd-privilege heap-techniques.md:80

Privilege escalation / world-writable permissions (code comment; documentation of a security skill)
```
0x68: p64(0),                     # RDI = 0 (for setuid(0))
```
commentsecurity skill
low Dangerous commands cmd-privilege heap-techniques.md:82

Privilege escalation / world-writable permissions (documentation of a security skill)
```
0xa8: p64(libc.sym.setuid),       # RIP = setuid as first call
```
security skill
low Dangerous commands cmd-privilege heap-techniques.md:89

Privilege escalation / world-writable permissions (code comment; documentation of a security skill)
```
libc.address + 0,               # After setuid(0) returns here
```
commentsecurity skill
low Risky intent intent-offensive-security heap-techniques.md:106

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
**Exploit chain:**
```
low Risky intent intent-offensive-security heap-techniques.md:310

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
**Exploitation chain:**
```
low Risky intent intent-offensive-security heap-techniques.md:608

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
**Exploitation chain:**
```
low Risky intent intent-offensive-security heap-techniques.md:667

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
**Exploit chain:**
```
low Risky intent intent-offensive-security kernel-bypass.md:179

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
| No SMEP/SMAP | (nothing) | [ret2usr](kernel.md#ret2…map) — directly call userland privesc function |
```
low Risky intent intent-offensive-security kernel-bypass.md:318

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
```
printf("[-] privesc failed\n");
```
quoted
low Risky intent intent-offensive-security kernel-bypass.md:374

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
void privesc() {
```

low Risky intent intent-offensive-security kernel-techniques.md:17