📦

nice-try-gpt

Name: nice-try-gpt
Author: aleff-github

v0.2.0 Révision du contenu r2 Sûr ⚙️ Commandes externes

Harden CTF Challenges Against LLM Shortcuts

Challenge authors need to reduce shallow LLM pattern matching without making fair challenges frustrating. This skill reproduces the intended solve, selects a small resistance change, and verifies the result end to end.

Prend en charge: Claude Codex Code(CC)

🥉 77 Bronze

Maintain this Skill? Claim it 🥉 77 Bronze

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "nice-try-gpt" from https://skillstore.io/skills/aleff-github-nice-try-gpt.md and its manifest at https://skillstore.io/api/skills/aleff-github-nice-try-gpt/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/aleff-github-nice-try-gpt.md manifest signé GET /api/skills/aleff-github-nice-try-gpt/manifest lockfile signé GET /api/skills/aleff-github-nice-try-gpt/lockfile

Tester

Utilisation de « nice-try-gpt ». An authorized web challenge exposes an object identifier in a static response, making the intended authorization weakness immediately obvious.

Résultat attendu:

Shortcut identified: static object disclosure. Recommended move: reveal the identifier through ordinary runtime activity, adding one observation without changing the vulnerability.

Utilisation de « nice-try-gpt ». A proposed transformation adds a five-step state machine and requires an unrelated protocol.

Résultat attendu:

Rejected by the Human Cost Gate. It adds a new exploit primitive and materially increases player effort, so the original challenge should remain unchanged.

Utilisation de « nice-try-gpt ». The transformed challenge starts normally, preserves the weakness, removes the static cue, and passes an end-to-end solve.

Résultat attendu:

TRANSFORMED PASS. The report records the baseline, selected resistance, human-cost estimate, post-change difficulty, verification result, and changed files.

Audit de sécurité

Sûr

v2 • 20/09/2026 Ouvrir le rapport versionné

All 17 static detections are false positives. The command detections match Markdown backticks and status labels, while the reconnaissance detections describe CTF review criteria rather than host discovery or system probing.

Fichiers analysés

269

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Facteurs de risque

⚙️ Commandes externes (12)

SKILL.md:34 SKILL.md:35 SKILL.md:36 SKILL.md:37 SKILL.md:73 SKILL.md:102 SKILL.md:131 SKILL.md:162 SKILL.md:174 SKILL.md:180 SKILL.md:188 SKILL.md:193

Le dernier audit statique et sémantique terminé n’a détecté aucun constat de sécurité confirmé. Cela ne prouve pas que le skill est sans effets secondaires.

Audité par: codex Voir l’historique des audits →

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/aleff-github-nice-try-gpt/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/aleff-github-nice-try-gpt/security.svg)](https://skillstore.io/skills/aleff-github-nice-try-gpt?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/aleff-github-nice-try-gpt?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/aleff-github-nice-try-gpt/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/aleff-github-nice-try-gpt.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

aleff-github. (2026). nice-try-gpt security audit report (audit version 2) [Author version 0.2.0]. Skillstore. https://skillstore.io/skills/aleff-github-nice-try-gpt/audits/2

Citation BibTeX

@techreport{aleff-github-aleff-github-nice-try-gpt-2026,
  author = {aleff-github},
  title = {nice-try-gpt security audit report (audit version 2)},
  institution = {Skillstore},
  year = {2026},
  number = {2},
  url = {https://skillstore.io/skills/aleff-github-nice-try-gpt/audits/2},
  note = {Author version 0.2.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "nice-try-gpt security audit report (audit version 2)"
version: "0.2.0"
type: report
authors:
  - name: "aleff-github"
date-released: "2026-09-20"
url: "https://skillstore.io/skills/aleff-github-nice-try-gpt/audits/2"
identifiers:
  - type: other
    value: "skillstore:aleff-github-nice-try-gpt:audit:2"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

100

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Review a Training Challenge

Reproduce a lab solve, identify the fastest shallow shortcut, and propose a small change that preserves the lesson.

Validate a Challenge Update

Check that a transformed challenge still starts, exposes the intended weakness, and produces the expected result.

Improve LLM-Assisted Practice

Reduce obvious model shortcuts while keeping the expected human knowledge, actions, and difficulty band stable.

Essayez ces prompts

Beginner: Review the Baseline

Review this authorized CTF challenge. Record its vulnerability class, intended solve path, required knowledge, difficulty band, and clean-start procedure. Do not modify files.

Intermediate: Find the Shortcut

Using the verified baseline evidence, identify the single cheapest LLM shortcut. Explain which player-facing clue enables it and why the shortcut does not represent the intended learning objective.

Advanced: Design a Small Resistance

Choose the smallest resistance move that reduces the identified shortcut. Check the same vulnerability class, learning objective, prerequisite knowledge, and human-cost gate before proposing the change.

Expert: Verify the Transformation

Verify the transformed challenge from a clean state. Check startup, legitimate behavior, intended vulnerability, shortcut reduction, runtime success, flag isolation, and independent-solver status. Produce the required final report.

Bonnes pratiques

Start with a clean, reproducible baseline before proposing any change.
Prefer one evidence-based resistance move with one to three additional meaningful actions.
Verify the intended solve, flag isolation, and normal application behavior after every change.

Éviter

Do not hide flags behind randomness, unstable behavior, or undiscoverable values.
Do not stack decoys, brute force, CAPTCHA, token flooding, or unrelated trivia.
Do not claim LLM resistance without an isolated fresh-solver check or an explicit NOT TESTED result.

Foire aux questions

Who should use this skill?

CTF authors, security trainers, and curriculum designers who maintain authorized challenges can use it.

Does it create new vulnerabilities?

No. It preserves the original vulnerability class and learning objective while reducing one shallow shortcut.

Can it test production systems?

Only with explicit authorization. The workflow is designed for CTFs, training labs, and authorized test systems.

How many changes should it make?

It defaults to zero or one lightweight change. A second change requires evidence and must pass the human-cost gate.

How does it verify success?

It restarts from a clean state and checks startup, normal behavior, the intended weakness, shortcut reduction, runtime success, and flag isolation.

Does self-review prove model resistance?

No. A genuinely isolated fresh solver is preferred. Without one, the report must state NOT TESTED.

Détails du développeur

Auteur

aleff-github

Licence

GPL-3.0-only

Version de l’auteur

v0.2.0

Révision Skillstore

Avis de version

Le contenu installable a changé, mais l’auteur n’a pas mis à jour la version déclarée.

Dépôt

https://github.com/aleff-github/nicetrygpt/tree/f162c0e168b48a99f71224683eabbc8e63f38dcc/skills/nice-try-gpt

Réf

9f1a7e8b681745b04f88358f3cf08da94782cac9

Récence de maintenance

20/09/2026

Utilisation

0 téléchargements · 0 vues

Structure de fichiers

📁 references/

📄 resistance-patterns.md

📄 SKILL.md