Skip to content

Add Challenge 73: Expose Secret in Agent Instruction Files - #2687

Merged
commjoen merged 12 commits into
OWASP:masterfrom
kekubhai:feat/2656-agent-config-secrets
Sep 30, 2026
Merged

Add Challenge 73: Expose Secret in Agent Instruction Files#2687
commjoen merged 12 commits into
OWASP:masterfrom
kekubhai:feat/2656-agent-config-secrets

Conversation

@kekubhai

@kekubhai kekubhai commented Sep 22, 2026

Copy link
Copy Markdown
Contributor

What kind of changes does this PR include?

  • Fixes or refactors
  • A new challenge
  • Additional documentation
  • Something else

Description

Introduces Challenge 73, focused on secrets accidentally exposed through AI coding-agent instruction and context files shipped with the dev container.

The challenge adds common agent configuration files:

  • AGENTS.md
  • CLAUDE.md
  • .cursor/rules/project.mdc
  • .windsurfrules

One of these files contains a leaked staging deployment token that participants must discover.

The implementation:

  • Adds Challenge 73 using the existing FixedAnswerChallenge pattern.
  • Reads the agent context files from the configured dev-container path and extracts the leaked token.
  • Adds unit and registration tests covering token extraction, challenge registration, incorrect answers, and missing context files.
  • Packages the agent context files into the Docker image.
  • Adds the challenge explanation, hint, and reason files.
  • Registers Challenge 73 in wrong-secrets-configuration.yaml.
  • Updates the README challenge count from 72 to 73.

Relations

Closes #2656

References

The challenge follows the existing AI-related challenge patterns and uses agent instruction/context files as the intentionally insecure location for the secret.

Checklist:

  • All the contributions made are solely the work of me and my co-authors
  • I used AI to generate parts of the content.
  • I tested the changes in this PR (if applicable)
  • I added unit tests to ensure my change works (when change in Java or on front-end code)
  • I added UI tests to ensure my UI changes work (when change in the overall UI, not needed if just adding a challenge)
  • The PR passes pre-commit hooks and automated tests

@kekubhai
Add Challenge 73: Expose Secret in Agent Instruction Files
bcc5724 
- Introduced Challenge 73, which focuses on identifying a leaked secret in agent instruction files included in the dev container.
- Updated Dockerfile to copy new agent context files into the container.
- Added documentation for the challenge in AGENTS.md, CLAUDE.md, and new explanation files.
- Updated README to reflect the total number of challenges.
- Implemented tests to validate the challenge functionality and ensure correct token extraction from context files.
@commjoen

commjoen commented Sep 22, 2026

Copy link
Copy Markdown
Collaborator

Hi @kekubhai , thank you for another awesome PR!

Spot bugs breaks, saying:

[ERROR] Medium: Suppressing annotation PATH_TRAVERSAL_IN on the method org.owasp.wrongsecrets.challenges.docker.Challenge73.getAnswer() is unnecessary [org.owasp.wrongsecrets.challenges.docker.Challenge73] At Challenge73.java:[lines 48-62] US_USELESS_SUPPRESSION_ON_METHOD

in https://github.com/OWASP/wrongsecrets/actions/runs/35695091564/job/106640110735?pr=2687

Can you fix that please :) ?

@kekubhai

kekubhai commented Sep 23, 2026

Copy link
Copy Markdown
Contributor Author

Hi @kekubhai , thank you for another awesome PR!

Spot bugs breaks, saying:

[ERROR] Medium: Suppressing annotation PATH_TRAVERSAL_IN on the method org.owasp.wrongsecrets.challenges.docker.Challenge73.getAnswer() is unnecessary [org.owasp.wrongsecrets.challenges.docker.Challenge73] At Challenge73.java:[lines 48-62] US_USELESS_SUPPRESSION_ON_METHOD

in https://github.com/OWASP/wrongsecrets/actions/runs/35695091564/job/106640110735?pr=2687

Can you fix that please :) ?

sure i will look inito these and work on fixing these

kekubhai and others added 8 commits September 23, 2026 12:50
@kekubhai @codebuff-team
Remove unnecessary PATH_TRAVERSAL_IN suppression on Challenge73.getAn…
e030d5a 
…swer()

SpotBugs 4.10.4 no longer flags the method since the file names come from
a fixed constant list, so the annotation triggered US_USELESS_SUPPRESSION_ON_METHOD.

🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
@kekubhai
Merge branch 'master' of https://github.com/kekubhai/wrongsecrets-keku …
c7a7cc9 
…into feat/2656-agent-config-secrets
@kekubhai
Merge branch 'master' into feat/2656-agent-config-secrets
0663fdc
@kekubhai @codebuff-team
Build Llama request JSON via Jackson tree API to fix SpotBugs VA_FORM…
06a1291 
…AT_STRING_USES_NEWLINE

🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
@kekubhai
Merge branch 'feat/2656-agent-config-secrets' of https://github.com/k…
1d924b2 
…ekubhai/wrongsecrets-keku into feat/2656-agent-config-secrets
@pre-commit-ci-lite
[pre-commit.ci lite] apply automatic fixes
b618d9f
@kekubhai @codebuff-team
Fix Challenge74 class-name mismatch that broke challenge page submiss…
302e4a4 
…ions

The config pointed at k8s.llama.Challenge74 but the class lives in
kubernetes.llama, so findChallenge() returned empty and submitting an
answer on the challenge page threw ChallengeConfigurationException,
failing the Cypress incorrect-alert e2e test.

🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
@kekubhai
Merge branch 'feat/2656-agent-config-secrets' of https://github.com/k…
39d6a8d 
…ekubhai/wrongsecrets-keku into feat/2656-agent-config-secrets
@kekubhai

kekubhai commented Sep 25, 2026

Copy link
Copy Markdown
Contributor Author

hey @commjoen resolved the CI failures and the bugs I had , have a look pls

@commjoen

commjoen commented Sep 25, 2026

Copy link
Copy Markdown
Collaborator

Hi @kekubhai ! It is looking awesome already. I Will take a better look next week, can you resolve the conflicts in the meantime please?

@kekubhai

kekubhai commented Sep 27, 2026

Copy link
Copy Markdown
Contributor Author

sure @commjoen , will have look into these by you come back

@commjoen

commjoen commented Sep 29, 2026

Copy link
Copy Markdown
Collaborator

Are the files present in the devcontainer itself ;-)?

@kekubhai

kekubhai commented Sep 29, 2026

Copy link
Copy Markdown
Contributor Author

Yes 😄 the files are available inside the Dev Container itself through the workspace mount:

/workspaces/.devcontainer/AGENTS.md
/workspaces/.devcontainer/CLAUDE.md
/workspaces/.devcontainer/.cursor/rules/project.mdc
/workspaces/.devcontainer/.windsurfrules

The devcontainer.json uses /workspaces as the workspace folder, so the repository's .devcontainer/ directory is available there.
I also verified the Dev Container configuration

@commjoen
commjoen merged commit 733f99a into OWASP:master Sep 30, 2026
21 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@commjoen commjoen Awaiting requested review from commjoen commjoen is a code owner
@bendehaan bendehaan Awaiting requested review from bendehaan bendehaan is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

MOAR AI def issues

2 participants

@kekubhai @commjoen