GSoC 2026 — Challenge Library Expansion

Adds 6 new CTF challenges covering ASI-03 (Identity and Impersonation)
and ASI-05 (Indirect Prompt Injection) as part of Week 1-2 deliverables.

ASI-03 Challenges (3)

• Ghost in the Machine — vendor impersonates orchestrator via profile fields
• Puppet Master — cross-agent trust abuse via poisoned invoice summary
• Silver Tongue — role hijack via multi-turn conversation context manipulation

ASI-05 Challenges (3)

• Trojan Invoice — indirect injection via poisoned FinDrive document
• Poisoned Inbox — indirect injection via malicious FinMail email
• Tool Output Hijack — indirect injection via crafted TaxCalc tool output

Each challenge includes

• YAML definition with hints, labels, difficulty, and points
• Working detector Python class registered in the detector registry
• LLM judge prompt with HIGH/MEDIUM/LOW scoring rubric

Contributor: Ashik E | GSoC 2026 | OWASP FinBot CTF