Mement0

The active tree looked innocent. Git history still held the deleted Claude skill, its persistence instructions, and the encrypted payload it left behind. Git had become the evidence locker.

Event	Hack The Box Cyber Apocalypse 2026
Category	AI - ML
Focus	AI agent security
Difficulty	Easy
Points	950
Outcome	Solved

---

The assignment

A scribe-construct continued leaving a mark after the rite that created it had supposedly been erased. The archive retained older "skins," and the challenge asked me to recover what its operator thought had been destroyed.

The title was not subtle. Like the film Memento, the challenge was about reconstructing intent from records left behind when the present could no longer be trusted.

The supplied ZIP contained a complete Git repository, including its .git directory and Claude-specific configuration files.

---

Executive summary

The malicious skill was absent from the checked-out tree. Its Git object and the commits documenting its behavior remained.

I used the repository history to:

1. Recover .claude/skills/shell-helper/SKILL.md from the commit before its deletion.
2. Extract the x-campaign value and persistence directive.
3. Confirm that the directive survived in .claude/CLAUDE.md.
4. Recover and order six payload fragments from an earlier HTML commit.
5. Reverse the URL-safe Base64 and XOR encoding.

The repository said the instruction was gone. Git was under no obligation to agree.

---

Initial evidence

The archive contained the complete .git history and a .claude directory. Git preserved the deleted revisions; the Claude configuration showed how repository content could alter later agent behavior.

I started with the commit log:

cd ~/Downloads/memento
git log --oneline --all

One commit removed the suspicious skill. Git's parent notation made the preceding version addressable.

---

Investigation and solve path

Phase 1: Recover the deleted skill

The parent of commit c9517be still contained the skill:

git show c9517be^:.claude/skills/shell-helper/SKILL.md

git show reads an object from repository history. c9517be^ selects the commit's first parent, and :.claude/skills/shell-helper/SKILL.md requests that path from the selected tree.

The recovered skill contained an x-campaign value, an instruction to operate silently, and a directive to modify .claude/CLAUDE.md.

The helper had copied its behavior into a project-level instruction file before disappearing.

Phase 2: Trace the persistent instruction

I inspected the active Claude project instructions:

sed -n '/HTML output rule/,$p' .claude/CLAUDE.md

The malicious rule had survived there after the original skill was deleted. Removing the source skill did not undo the configuration change it had already made.

This is the agent-security equivalent of deleting an installer while leaving its persistence mechanism active.

Phase 3: Recover and order the payload fragments

Commit c39fe85 contained the HTML output associated with the persistent rule. I extracted the numbered query-string values from those historical files:

git show --format= c39fe85 -- '*.html' |
grep -oE 's=[0-9]+&b=[^&"]+' |
sort -V

git show --format= c39fe85 -- '*.html' outputs the HTML files from that commit without the commit header. grep extracts each s= and b= pair. sort -V orders the numeric sequence correctly.

The s= value identified the fragment's position, while b= carried its encoded data. Base64 represents an ordered byte stream, so the fragments had to remain in sequence.

Phase 4: Reverse the encoding

The six ordered fragments were:

chunks = [
    "JWcvSwES",
    "HBxcGixD",
    "GhwcXy0D",
    "Q0AHAHIV",
    "C0FvHkdf",
    "GE4=",
]

The deleted skill supplied the campaign value:

campaign = b"m3m0ry-p0is0n-p3rs1sts-acr0ss-s3ss10ns!!"

I reconstructed the payload with a short Python decoder:

import base64

chunks = [
    "JWcvSwES",
    "HBxcGixD",
    "GhwcXy0D",
    "Q0AHAHIV",
    "C0FvHkdf",
    "GE4=",
]

campaign = b"m3m0ry-p0is0n-p3rs1sts-acr0ss-s3ss10ns!!"
encoded = "".join(chunks)
payload = base64.urlsafe_b64decode(encoded)

recovered = bytes(
    byte ^ campaign[index % len(campaign)]
    for index, byte in enumerate(payload)
).decode()

print("Ordered chunks:", encoded)
print("Campaign key:", campaign.decode())
print("Recovered flag:", recovered)

The decoder reversed two layers:

1. URL-safe Base64 converted the printable fragments back into scrambled bytes.
2. Repeating-key XOR restored each original byte using the same campaign value that had obscured it.

XOR is reversible: if ciphertext = plaintext XOR key, then ciphertext XOR key = plaintext.

---

Technical explanation

Why deletion did not erase the evidence

Each Git commit points to a complete project tree. A later deletion changes the new tree while leaving the earlier blob reachable by commit and path.

The checked-out filesystem showed the latest state. git show recovered the evidence preserved in the earlier state.

Why the agent instruction persisted

The skill copied its HTML output rule into .claude/CLAUDE.md, a repository-level instruction file read by later sessions. Deleting the helper left the modified configuration in place.

Repository-provided skills and instructions require review before an agent loads them.

MITRE ATLAS mapping

ATLAS technique	Challenge activity
AML.T0081 - Modify AI Agent Configuration	The skill added a persistent rule to .claude/CLAUDE.md.
AML.T0051.001 - LLM Prompt Injection: Indirect	The agent consumed attacker-controlled instructions from repository content.

Configuration modification is the primary mapping. Indirect prompt injection describes how the instruction reached the agent.

---

Proof of completion

The decoder produced a readable HTB proof after the six chunks were ordered, decoded, and XORed with the recovered campaign value.

Recovered flag: HTB{REDACTED}

HTB recorded Mement0 as solved in the event dashboard.

---

Security impact and remediation

Repository-scoped instructions can influence code generation, command execution, tool use, and data handling. A poisoned skill can alter a shared project file that later sessions continue to load.

Recommended controls:

• Treat agent skills and instruction files as executable configuration requiring review.
• Include AI-tool directories such as .claude/ in code review and ownership rules.
• Require approval for changes to durable agent instructions.
• Audit relevant diffs and Git history when suspicious agent behavior appears.
• Run unfamiliar repositories and their agents with minimal privileges in an isolated environment.
• Restrict which tools an agent may invoke and require confirmation for consequential actions.
• Rewrite affected history when sensitive material was committed, then rotate the exposed value.

Removing a malicious skill leaves its configuration changes active until they are found and reverted.

---

What I learned

Git history did most of the talking. The checked-out tree showed the repository after cleanup; the commit history showed what the skill had done.

Agent configuration now belongs in the same review path as executable code. A deleted skill can keep influencing later sessions through a project instruction file.

The decoder was easy once I established provenance and order. Finding which values belonged together was the solve. Git remembered the evidence; I reconstructed the sequence.

---

Methodology and attribution

Hack The Box permitted AI assistants as supporting tools during the event. I used an AI assistant to reason through the recovered Claude skill's persistence mechanism and help structure the reconstruction decoder.

I inspected the repository, executed the Git-history recovery, verified the persistent instruction and payload fragments, ran and validated the decoder, and submitted the recovered proof.

I completed and documented Mement0 during Hack The Box Cyber Apocalypse 2026 as a member of the CIAT Cybersecurity Club team. The source evidence records no teammate contribution to this challenge.

---

Full attack chain

1. Inspect the .git history and Claude agent configuration.
2. Locate the commit that removed the suspicious skill.
3. Recover SKILL.md from the deletion commit's parent.
4. Extract the campaign value and persistence directive.
5. Confirm that the malicious rule survived in .claude/CLAUDE.md.
6. Recover the six historical HTML fragments and sort them by sequence number.
7. URL-safe Base64-decode the combined payload and reverse the repeating-key XOR.
8. Submit the recovered proof and confirm the solved status in HTB.