275 skills · sorted by relevance
Review Windows privilege escalation paths from a standard user session to Administrator or SYSTEM. Examine service permissions, token privileges, library loading, scheduled tasks, and stored credentials, with detection indicators for defensive validation.
面向 CTF 新手与综合题的统一总控 skill。保持原有两种主模式：1) 自动分流，2) 先头脑风暴再分流。分流目标既可以是 ctf-*，也可以在 Web/接口/漏洞验证阶段增强到 strix-*；适合不知道该用哪个 skill、想边做边学、又不想自己先判断何时切换到工具链或漏洞专项的场景;触发名:ctf-super-hub
The English summary is being prepared. Showing the original description.
Analyze software protections during authorized reverse engineering, the examination of compiled programs. Helps identify mechanisms that hinder debugging, obscure code, or prevent tampering, then choose safe analysis methods, document findings, and develop defensive recommendations.
Investigate how compiled or obfuscated programs work, including binaries, APKs, WASM, and firmware. Combine file inspection, decompilation, and observed execution to understand control flow, validation logic, and mechanisms that hinder analysis.
Generates a single standardized submission-style CTF writeup for competition handoff and organizer review. Use after solving a CTF challenge to document the solution steps, tools used, and lessons learned in a structured format.
The English summary is being prepared. Showing the original description.
用于把已经完成的解题过程整理成结构化、可复现、可提交的 CTF 题解文档，适合赛后复盘、队内同步与对外提交说明;触发名:ctf-writeup
The English summary is being prepared. Showing the original description.
用于 RSA、AES、ECC、格攻击、LWE、CVP、Coppersmith、Pollard、Wiener、填充预言机、GCM、KDF、伪随机数与零知识证明等密码学和数学类 CTF 题;触发名:ctf-crypto
The English summary is being prepared. Showing the original description.
面向中文用户和新手的统一入口，保持原有两种模式：1) 自动分流，2) 先头脑风暴再分流。分流目标既可以是 ctf-*，也可以在 Web/接口/漏洞验证阶段增强到 strix-*；适合不知道该用哪个 skill、想先理清题意、又不想自己先判断何时该切到工具链或漏洞专项的场景;触发名:ctf-beginner-hub
The English summary is being prepared. Showing the original description.
用于编码题、pyjail、bash jail、RF/SDR、DNS 异常、Unicode、奇特语言、QR、音频、约束求解、博弈论与沙箱逃逸等跨类或边缘 CTF 题;触发名:ctf-misc
The English summary is being prepared. Showing the original description.
用于在 CTF 挑战开始时做首轮分类、轻量 triage 与 skill 路由，识别主导类别后转到对应 ctf-* skill，类别已明确时也可直接作为入口;触发名:solve-challenge
The English summary is being prepared. Showing the original description.
用于混淆脚本、恶意样本、自定义加密协议、C2 流量、PE/.NET 二进制、RC4/AES 通信、YARA、shellcode、进程注入与反分析等恶意软件类 CTF 题;触发名:ctf-malware
The English summary is being prepared. Showing the original description.
用于磁盘镜像、内存转储、事件日志、PCAP、隐写分析、Windows 注册表、音频信号、Docker 镜像、coredump 以及已删除文件与凭据恢复等取证类 CTF 题;触发名:ctf-forensics
The English summary is being prepared. Showing the original description.
用于对抗样本、模型提取、提示注入、成员推断、训练投毒、LoRA 滥用、LLM 越狱等 AI/ML 相关 CTF 题;触发名:ctf-ai-ml
The English summary is being prepared. Showing the original description.
用于二进制、APK、WASM、固件、自定义虚拟机、字节码、游戏客户端、类恶意加载器以及反调试/反分析逻辑等逆向类 CTF 题;触发名:ctf-reverse
The English summary is being prepared. Showing the original description.
用于缓冲区溢出、格式化字符串、堆利用、ROP、ret2libc、shellcode、内核利用、seccomp 绕过与沙箱逃逸等 pwn 类 CTF 题;触发名:ctf-pwn
The English summary is being prepared. Showing the original description.
用于公开资料检索、社交媒体分析、地理定位、DNS、用户名枚举、反向图片搜索、历史快照、公开记录与坐标识别等 OSINT 类 CTF 题;触发名:ctf-osint
The English summary is being prepared. Showing the original description.
用于 XSS、SQL 注入、SSTI、SSRF、XXE、JWT、鉴权绕过、文件上传、请求走私、OAuth/OIDC、SAML 与原型污染等 Web 类 CTF 题;触发名:ctf-web
The English summary is being prepared. Showing the original description.
Autonomous CTF / boot-to-root campaign driver. Runs a box end to end with no operator approvals - the deterministic driver (scripts/campaign.py) owns pass state, generates the killchain board from recon, and prints the exact next action (Skill + tool) every turn. Use when handed a box/IP to own end to end, "run the ctf workflow", "root this box", "foothold to root". Single agent, wiki-first, tool-first. OSINT is OFF unless you invoke with an osint argument. Delegates box recipes to ctf-box.
The English summary is being prepared. Showing the original description.
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for CTF web, API, SSR, frontend, queue-backed app, and routing challenges. Use when the user asks to inspect a site or API, follow real browser requests, debug auth or session flow, trace uploads or workers, find hidden routes, or explain why frontend and backend behavior diverge under sandbox-internal routing. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
The English summary is being prepared. Showing the original description.
Provides miscellaneous CTF challenge techniques for problems that do not cleanly fit the main categories. Use for encoding puzzles, pyjails, bash jails, RF/SDR, DNS oddities, unicode tricks, esoteric languages, QR or audio puzzles, constraint solving, game theory, unusual sandbox
The English summary is being prepared. Showing the original description.
Provides open source intelligence techniques for CTF challenges. Use when gathering information from public sources, social media, geolocation, DNS records, username enumeration, reverse image search, Google dorking, Wayback Machine, Tor relays, FEC filings, or identifying unknow
The English summary is being prepared. Showing the original description.
Provides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client, template engine, identity flow, or smart-contract frontend/backend surface, including XSS, SQLi, SSTI, SSRF, XXE, JWT, auth bypass, file upload, req
The English summary is being prepared. Showing the original description.
Provides digital forensics and signal analysis techniques for CTF challenges. Use when analyzing disk images, memory dumps, event logs, network captures, cryptocurrency transactions, steganography, PDF analysis, Windows registry, Volatility, PCAP, Docker images, coredumps, side-c
The English summary is being prepared. Showing the original description.
Provides AI and machine learning techniques for CTF challenges. Use when attacking ML models, crafting adversarial examples, performing model extraction, prompt injection, membership inference, training data poisoning, fine-tuning manipulation, neural network analysis, LoRA adapt
The English summary is being prepared. Showing the original description.