File-Scheme

The hardened secretpickle runs pickle.loads in a write-only seccomp sandbox, but the adminbot action visits an attacker URL with no scheme check and returns a screenshot, so file:///flag.txt renders the flag into the image.