Writeup for Super Short Python Golf

Problem

This is a challenge called Daily AlpacaHack 2026/05/13 Super Short Python Golf.

What I tried

I checked the distributed files.

jail.py

import os

ALPACA_FLAG = os.environ.get("FLAG", "Alpaca{dummy}")

code = input("code > ")

if len(code) > 6:
print("Too long")
exit()

if not code.isascii():
print("Not ASCII")
exit()

eval(code)

code = input("code > ")

This outputs "code > " to the screen and saves the user's standard input to the variable code.

if len(code) > 6:
    print("Too long")
    exit()

If the number of entered characters is greater than 6, it displays "Too long" and terminates the program.

if not code.isascii():
    print("Not ASCII")
    exit()

It checks if all input characters are ASCII characters (alphanumeric, symbols, etc.); if not, it displays "Not ASCII" and terminates the program.

eval(code)

This is a very powerful function that interprets a string as Python program code and executes it. You often hear that eval is dangerous.

I looked for built-in Python functions of 6 characters or less that can interfere with standard output or standard input. There is help(). When I entered it, it entered an interactive mode. Here, the character count limit and character check no longer apply. While the help> prompt was displayed, I entered __main__, which is the module name referring to the script currently being executed. Python's help system listed the information of the __main__ module on the screen. The flag was also there.

FLAG

Alpaca{h3lp_m3_Im_scar3d}

Other

In Python, the script currently being executed directly is treated under the module name __main__. Entering __main__ into the help system is equivalent to giving the command "Show me the specifications of this entire script (module)!" The help system parses the contents of the __main__ module and politely outputs a list of what functions exist and what variables are defined (DATA) to the screen. As a result, the name of the ALPACA_FLAG variable defined at the top of the script, and even the flag read from the environment variable, were displayed on the screen.