Mement0

CACTF2026

Task: a Git repo of a static site bundled with a Claude Code agent config where a malicious skill was deleted in a later commit. Solution: recover the pruned SKILL.md from Git history, read its documented beacon encoding, then reassemble per-page HTML beacons in sequence order, urlsafe-base64 decode and repeating-key XOR against the campaign id to rebuild the flag.