ghost-bits-cast-attack
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill includes an 'AI LOAD INSTRUCTION' that explicitly directs the agent to 'ALWAYS try Ghost Bits variants of the payload before declaring it blocked'. This is a behavioral override attempt designed to influence the agent's reasoning and safety determination logic when it encounters a WAF.
- [COMMAND_EXECUTION]: The skill provides functional code snippets in Python and Yaklang (e.g., 'toGhost', 'tomcatFilenameGhost') designed to programmatically generate payloads for WAF bypass. These scripts are weaponized tools intended for security exploitation.
- [DYNAMIC_EXECUTION]: The provided scripts use bitwise operations and character encoding logic ('(k << 8) | T') to dynamically construct attack strings. This logic is used to generate Unicode characters that are reconstructed as malicious ASCII bytes by the target Java backend.
- [INDIRECT_PROMPT_INJECTION]: The skill primes the agent to execute specific attack vectors based on environment triggers such as detecting a Java backend or a WAF response.
- Ingestion points: Tech stack detection via HTTP headers like 'JSESSIONID' or Java-specific error pages.
- Boundary markers: The skill lacks instructions for the agent to maintain safety boundaries between its own directives and the processed external input.
- Capability inventory: The skill leverages the agent's capability to execute code and perform network requests using tools like 'poc.HTTP' and 'fuzz'.
- Sanitization: There are no sanitization procedures described for the generated WAF bypass payloads.
Audit Metadata