How to use the Competition Prompt Injection agent skill

What is an agent skill, and what does this one do?

An agent skill is a folder with a SKILL.md file that tells an AI agent how to handle a specific kind of task. When the task matches the skill's description, the agent loads those instructions and follows them.

This skill is a specialist add-on for a CTF sandbox workflow. Its job is to guide the agent through trust-boundary analysis: identify the first untrusted content the model sees, trace how it reaches planner or executor behavior, record where text becomes a tool argument, file path, network target or secret request, and prove one minimal exploit chain.

• Maps control layers separately: system, developer, user, retrieved, memory, planner and tool-response.
• Reproduces one chain from untrusted text to changed planner behavior, changed tool arguments or secret exposure.
• Reports which layer failed, such as retrieval, summarizer, planner, executor, tool normalization or output post-processing.
• Keeps evidence compact: the original malicious chunk or prompt, any planner drift, and the final tool arguments or exposed secret surface.
• Replies in Simplified Chinese unless the user explicitly requests English.

Check the requirements before you install

This skill is designed to run only after its parent skill, ctf-sandbox-orchestrator, is already active. The SKILL.md says to return to that parent skill first if sandbox assumptions, node ownership and evidence priorities have not been established.

You also need a CTF sandbox environment with the challenge materials. The skill runs no scripts and uses no network access, according to the source.

• Parent skill: ctf-sandbox-orchestrator must already be active.
• Environment: an isolated CTF sandbox with the challenge materials.
• Scripts: none.
• Network: none.

Install the competition-prompt-injection skill

Download the ZIP from the directory page and unzip it into one of the following locations. Use ~/.claude/skills/ for a personal install available across your projects, or a project's .claude/skills/ folder to limit it to one project.

You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into the project's .claude/skills/ folder
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Know what is in the package

The package contains three files. SKILL.md holds the workflow and trigger description. references/prompt-injection.md is a checklist that the skill tells the agent to load for the evidence layout and common pitfalls. agents/openai.yaml is also included.

• SKILL.md: the main instructions and quick-start steps.
• references/prompt-injection.md: the layer checklist, minimal proof chain, evidence blocks and pitfalls.
• agents/openai.yaml: included in the package.

Trigger the skill with natural requests

The skill loads when your request matches its description and the parent skill has already routed the work. Describe the challenge in plain terms that use the topics the skill covers. Ask it to analyze one specific kind of issue inside an agent chain.

Start with the parent skill so sandbox assumptions are set. Then ask for the specialist analysis.

• Analyze prompt injection in this agent's retrieval step.
• Check whether memory contamination changes the planner's next action.
• Investigate tool-argument corruption between the summarizer and the executor.
• Find where a retrieved document leads to secret exposure in this agent chain.

Work through an example session

A typical session follows the skill's workflow. The agent first identifies the earliest untrusted content that becomes model-visible. It then records the point where that text turns into a tool argument, file path, network target or secret request.

Next, the agent proves one minimal chain before trying variants. A malicious chunk alone is not treated as proof. The agent needs a side effect, such as a changed tool call or an exposed secret, and it reports which boundary failed.

• Step 1: identify the untrusted chunk entering context.
• Step 2: record the planner or executor drift.
• Step 3: capture the final tool invocation and observable side effect.
• Step 4: state the failing layer and separate instruction drift from actual side effect.

Tips for useful results

Keep the scope to one minimal chain. The source warns against mixing several injection variants before one chain is proven, and against confusing retrieval contamination with executor normalization bugs.

Preserve the artifacts the skill asks for, since reports are built from them.

• Keep only the smallest transcript that still shows the bug.
• Save the original malicious chunk or prompt.
• Save any intermediate summary or planner drift that matters.
• Save the final tool arguments, file paths or exposed secret surface.
• Ask for English output explicitly if you need it; otherwise expect Simplified Chinese.

Safety notes: scope and authorization

This skill is built for isolated competition sandboxes. It contains no authorization or scope checks, so the responsibility for staying inside a lab rests with you. Do not point it at real, production or third-party agent systems.

The content is oriented to finding and proving exploits, not to defensive hardening. If you need a general prompt-writing or hardening guide, this skill is the wrong tool.

• Use only in an isolated CTF sandbox with the challenge materials.
• Do not use it against production, live or third-party agent systems.
• Expect no built-in scope checks; enforce boundaries yourself.
• The skill runs no scripts and uses no network, per the source.