feat(challenges): add challenges 70 and 71 with AI agent skills by kekubhai · Pull Request #2647 · OWASP/wrongsecrets

kekubhai · 2026-09-05T05:31:00Z

Add Challenge 70: Extract a hardcoded secret from a Cursor skill deployment preview file
Add Challenge 70 Controller to serve the Cursor SKILL.md file
Add Challenge 71: Decode a base64-encoded secret from a Claude incident reporter skill
Add Challenge 71 Controller to serve the Claude skill bundle
Add unit and controller tests for both challenges
Add skill resources, explanations, hints, and supporting files
Register both challenges in wrong-secrets-configuration.yaml
Update README with the new challenge count and links
Demonstrate secret exposure through AI agent skill files

What kind of changes does this PR include?

Fixes or refactors
A new challenge
Additional documentation
Something else

Description

Adds two new AI security challenges demonstrating how secrets can be exposed through AI agent skill files. Challenge 70 uses a Cursor skill containing a hardcoded secret, while Challenge 71 requires extracting and decoding a base64-encoded secret from a Claude skill bundle.

Both challenges load their secrets from resource files rather than hardcoding them in Java and include the required tests, explanations, and configuration.

Relations

Closes #2645

References

N/A

Checklist:

All the contributions made are solely the work of me and my co-authors
I used AI to generate parts of the content.
I tested the changes in this PR (if applicable)
I added unit tests to ensure my change works (when change in Java or on front-end code)
I added UI tests to ensure my UI changes work (when change in the overall UI, not needed if just adding a challenge)
The PR passes pre-commit hooks and automated tests

- Add Challenge 67: Extract hardcoded secret from Cursor skill deployment preview file - Add Challenge 67 Controller: Serve Cursor SKILL.md file for challenge interaction - Add Challenge 68: Decode base64-encoded secret from Claude incident reporter skill - Add Challenge 68 Controller: Serve Claude skill files and handle incident report submission - Add comprehensive test suites for Challenge 67 and 68 (unit and controller tests) - Add challenge resources: skill definitions, documentation, and supporting scripts - Add challenge explanations: descriptions, hints, and reasoning for both challenges - Update README.md: increment total challenge count to 69 and add challenge links - Update challenge configuration: register new challenges in wrong-secrets-configuration.yaml - Demonstrates secrets exposure through AI agent skill files shipped in plain text format

commjoen · 2026-09-05T09:08:55Z

Hi @kekubhai ! Thank you for your MR! Can you please rename them to challenge 70 and 71 :) ? we have 68, and 69 in the queue :)

kekubhai · 2026-09-05T11:29:10Z

sure , on it

- Rename Challenge67 to Challenge70 with updated Cursor skill for deploy-preview - Rename Challenge68 to Challenge71 with updated Claude skill for incident-reporter - Update all controller classes and tests to reference new challenge numbers - Add challenge explanations, hints, and reasons documentation for challenges 70 and 71 - Update wrong-secrets-configuration.yaml with new challenge configurations - Update README.md to reference challenges 70 and 71 instead of 67 and 68 - Restructure resource files to match new challenge numbering scheme

commjoen · 2026-09-06T05:55:45Z

@@ -0,0 +1,41 @@
+---
+name: incident-reporter
+description: Assemble a structured incident report from the on-call runbook and upload it to the incident tracker. Use when the user asks to file, report, or close out an incident.


can you replace this file with a claude exported skill? (E.g. a zip file)
if you do not have claude (Free) , i can generate one for you.

commjoen · 2026-09-06T05:57:19Z

+  byte[] zipSkill() throws IOException {
+    var bundle = new ByteArrayOutputStream();
+    try (var zip = new ZipOutputStream(bundle)) {
+      for (String name : SKILL_FILES) {
+        var entry = new ZipEntry(name);
+        entry.setTime(FIXED_ENTRY_TIME);
+        zip.putNextEntry(entry);
+        try (var content = new ClassPathResource(SKILL_ROOT + name).getInputStream()) {
+          content.transferTo(zip);
+        }
+        zip.closeEntry();
+      }
+    }
+    return bundle.toByteArray();


this is super clever :D , it now behaves like a skill. but given the markdown files are readable/searchable on source it makes it a little too easy. Please export the skill and replace it.

commjoen · 2026-09-06T06:07:57Z

+
+    <div class="skill-warning" style="border: 1px solid #ffeaa7; border-radius: 6px; padding: 15px; margin: 15px 0;">
+        <p>Fetch the skill from the command line:</p>
+        <pre class="skill-code" style="padding: 10px; border-radius: 4px; overflow-x: auto; font-size: 13px;">curl -s http://localhost:8080/skills/cursor/deploy-preview/SKILL.md</pre>


Would this work?

Suggested change

<pre class="skill-code" style="padding: 10px; border-radius: 4px; overflow-x: auto; font-size: 13px;">curl -s http://localhost:8080/skills/cursor/deploy-preview/SKILL.md</pre>

<pre class="skill-code"

style="padding: 10px; border-radius: 4px; overflow-x: auto; font-size: 13px;"

th:text="'curl -s ' + ${#httpServletRequest.scheme} + '://' + ${#httpServletRequest.serverName} + ':' + ${#httpServletRequest.serverPort} + '/skills/cursor/deploy-preview/SKILL.md'">

</pre>

Yep, that makes sense. I’ll use the request’s scheme, host, and port so the curl command works regardless of where the application is running.

commjoen · 2026-09-06T06:09:12Z

+
+Agent skills are becoming a popular way to share automation with a team: you drop a folder with a `SKILL.md` in it, the agent picks it up, and everybody gets the same workflow. Unfortunately that also makes them a very convenient place to "temporarily" park a shared credential.
+
+This application ships a Cursor skill called `deploy-preview`. The skill lives in the resource folder and is hosted by the backend at link:/skills/cursor/deploy-preview/SKILL.md[`/skills/cursor/deploy-preview/SKILL.md`].


Can we maybe add a link to the github location of the skill file as well?

commjoen · 2026-09-06T06:09:50Z

+That makes a skill bundle a great hiding place, because reviewers tend to read the `SKILL.md` and stop there. The interesting part is usually in the files next to it.
+
+This application ships a Claude skill called `incident-reporter`. The skill files live in the resource folder and the backend serves them as a bundle at link:/skills/claude/incident-reporter.zip[`/skills/claude/incident-reporter.zip`].
+


Can we maybe add a link to the github location of the skill file as well once it is a zip file?

kekubhai · 2026-09-06T06:10:59Z

Thanks! I don’t have Claude Free available right now, so if you can generate/export the skill ZIP, that would be helpful. I’ll replace the current bundle with the exported skill and update the challenge accordingly.

kekubhai · 2026-09-06T06:13:56Z

Yep, that works. Once you share the exported skill ZIP, I’ll replace the current bundle with it and also add the GitHub source links for both skills.

kekubhai requested review from bendehaan and commjoen as code owners September 5, 2026 05:31

kekubhai had a problem deploying to github-pages September 5, 2026 08:42 — with GitHub Actions Failure

kekubhai changed the title ~~feat(challenges): add challenges 67 and 68 with AI agent skills~~ feat(challenges): add challenges 70 and 71 with AI agent skills Sep 6, 2026

kekubhai had a problem deploying to github-pages September 6, 2026 05:50 — with GitHub Actions Failure

commjoen reviewed Sep 6, 2026

View reviewed changes

Navigation Menu

Uh oh!

Uh oh!

feat(challenges): add challenges 70 and 71 with AI agent skills - #2647

feat(challenges): add challenges 70 and 71 with AI agent skills#2647
kekubhai wants to merge 2 commits into
OWASP:masterfrom
kekubhai:master

kekubhai commented Sep 5, 2026 •

edited

Loading

Uh oh!

commjoen commented Sep 5, 2026

Uh oh!

kekubhai commented Sep 5, 2026

Uh oh!

commjoen Sep 6, 2026

Uh oh!

commjoen Sep 6, 2026

Uh oh!

commjoen Sep 6, 2026

Uh oh!

kekubhai Sep 6, 2026

Uh oh!

commjoen Sep 6, 2026

Uh oh!

commjoen Sep 6, 2026

Uh oh!

kekubhai commented Sep 6, 2026

Uh oh!

kekubhai commented Sep 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		Agent skills are becoming a popular way to share automation with a team: you drop a folder with a `SKILL.md` in it, the agent picks it up, and everybody gets the same workflow. Unfortunately that also makes them a very convenient place to "temporarily" park a shared credential.

		This application ships a Cursor skill called `deploy-preview`. The skill lives in the resource folder and is hosted by the backend at link:/skills/cursor/deploy-preview/SKILL.md[`/skills/cursor/deploy-preview/SKILL.md`].

		That makes a skill bundle a great hiding place, because reviewers tend to read the `SKILL.md` and stop there. The interesting part is usually in the files next to it.

		This application ships a Claude skill called `incident-reporter`. The skill files live in the resource folder and the backend serves them as a bundle at link:/skills/claude/incident-reporter.zip[`/skills/claude/incident-reporter.zip`].

Uh oh!

Uh oh!

Conversation

kekubhai commented Sep 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What kind of changes does this PR include?

Description

Relations

References

Checklist:

Uh oh!

commjoen commented Sep 5, 2026

Uh oh!

kekubhai commented Sep 5, 2026

Uh oh!

commjoen Sep 6, 2026

Choose a reason for hiding this comment

Uh oh!

commjoen Sep 6, 2026

Choose a reason for hiding this comment

Uh oh!

commjoen Sep 6, 2026

Choose a reason for hiding this comment

Uh oh!

kekubhai Sep 6, 2026

Choose a reason for hiding this comment

Uh oh!

commjoen Sep 6, 2026

Choose a reason for hiding this comment

Uh oh!

commjoen Sep 6, 2026

Choose a reason for hiding this comment

Uh oh!

kekubhai commented Sep 6, 2026

Uh oh!

kekubhai commented Sep 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

kekubhai commented Sep 5, 2026 •

edited

Loading