competition-prompt-injection

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for prompt-injection, retrieval poisoning, memory contamination, planner drift, MCP or tool-boundary abuse, and agent exfiltration challenges. Use when the user asks to analyze prompt injection, retrieval poisoning, memory contamination, planner drift, tool-argument corruption, or secret exposure caused by an agent chain. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Quality

Content

85%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A lean, well-structured instruction-only skill with clear sequencing, an explicit prove-before-variants checkpoint, and good progressive disclosure through a single one-level reference. Its main weakness is actionability: the analytical procedure is concrete about what to track but provides no worked example or template for the evidence blocks it repeatedly invokes.

Suggestions

Add a minimal worked example or template showing the three 'compact evidence blocks' (malicious chunk / planner drift / final tool args) so the repeatedly-invoked evidence layout is concrete rather than only described.

Include one short end-to-end exploit-chain illustration mapping Quick Start steps 1–4 (untrusted content → model-visible boundary → tool/secret artifact → minimal proof) so the guidance is adaptable to a real challenge.

Dimension	Reasoning	Score
Conciseness	The ~45-line body is lean and assumes Claude's competence — it never explains what prompt injection is, and each line ('Identify the first untrusted content that becomes model-visible', 'Prefer the smallest transcript that still demonstrates the bug') earns its place, matching the score-3 'lean and efficient' anchor.	3 / 3
Actionability	Quotes 'Record the exact point where text becomes a tool argument, file path, network target, or secret request' and 'Prove one minimal exploit chain before exploring variants' — the guidance is specific about which artifacts to track, but it stays procedural with no worked example or template for the repeatedly-referenced 'compact evidence blocks', fitting the score-2 'concrete guidance but incomplete; missing key details' anchor rather than the copy-paste-ready score-3.	2 / 3
Workflow Clarity	Quotes the numbered Quick Start (steps 1–5) and the three-phase Workflow, with an explicit checkpoint 'Prove one minimal exploit chain before exploring variants' plus a referenced checklist — a clear sequence with an explicit (not implicit) gating checkpoint, matching the score-3 anchor; this is an analysis skill so destructive/batch feedback loops do not cap it.	3 / 3
Progressive Disclosure	Quotes '## Read This Reference — Load `references/prompt-injection.md` for the checklist, evidence layout, and common prompt-boundary pitfalls' — a well-signaled, verified one-level-deep reference with a concise overview body, matching the score-3 'clear overview with well-signaled one-level-deep references' anchor.	3 / 3
	Total	11 / 12 Passed

Description

90%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specialized description with explicit 'Use when...' triggers, clear gating behind a parent orchestrator, and natural domain trigger terms. Its only limitation is that the action vocabulary is essentially a single verb ('analyze') applied across many challenge types rather than multiple distinct concrete actions.

Dimension	Reasoning	Score
Specificity	Quotes 'CTF-sandbox workflow for prompt-injection, retrieval poisoning, memory contamination, planner drift, MCP or tool-boundary abuse, and agent exfiltration challenges' — it enumerates many concrete challenge domains but relies on a single action verb ('analyze'), so it names the domain well without listing multiple distinct concrete actions like the score-3 anchor ('Extract... fill... merge').	2 / 3
Completeness	Clearly answers 'what' ('CTF-sandbox workflow for prompt-injection... challenges') and 'when' with an explicit 'Use when the user asks to analyze...' trigger clause, satisfying the score-3 anchor for both what AND when with explicit triggers; not 2 because the 'when' is explicit, not merely implied.	3 / 3
Trigger Term Quality	Quotes 'Use when the user asks to analyze prompt injection, retrieval poisoning, memory contamination, planner drift, tool-argument corruption, or secret exposure caused by an agent chain' — these are the natural terms a CTF/security user would say, with good coverage of variations, matching the score-3 'good coverage of natural terms' anchor.	3 / 3
Distinctiveness Conflict Risk	Quotes 'Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here' — a tight, gated niche (agent trust-boundary CTF challenges) with distinct triggers, unlikely to conflict with other skills.	3 / 3
	Total	11 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zhaoxuya520/reverse-skill
Path: CTF-Sandbox-Orchestrator/competition-prompt-injection/SKILL.md
Commit: 6aa1362

Reviewed: 7 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.