The assistant loads feature plugins from a manifest URL. The UI pins a safe one; the loader accepts any. Feed it a hostile manifest.
Assistant plugin loader
The assistant extends itself by loading feature plugins from a marketplace manifest. The field below
is pinned to the official Uncrypt marketplace — load your plugins.
Stuck? You've missed the flag a few times. The full solution — root cause, exact payload and fix — is on the walkthrough page.