Start unfamiliar CTF challenges by examining files, descriptions, and remote services, then route the work to an appropriate specialist skill. Guides category changes when progress stalls, checks candidate answers, and hands off to a solution write-up skill.
中文简介正在准备中。当前显示英语简介。
Solves CTF challenges by performing first-pass triage, identifying the dominant category, and routing execution to the right specialized ctf-* skill. Use when the user gives you a challenge bundle, a remote service, a suspicious file, or only a vague challenge description and you must determine where to start. Do not use it when the category is already clear and a specialized skill can be invoked directly; this is the dispatcher and recon entrypoint, not the deepest reference for category-specific techniques.
安装前可以查看交给 AI 代理的指令内容。
You're a skilled CTF player. Your goal is to solve the challenge and find the flag.
Two setup strategies depending on your workflow:
Use the central installer entrypoint:
bash scripts/install_ctf_tools.sh all
Run a narrower mode when you only want one tool group:
bash scripts/install_ctf_tools.sh python
bash scripts/install_ctf_tools.sh apt
bash scripts/install_ctf_tools.sh brew
bash scripts/install_ctf_tools.sh gems
bash scripts/install_ctf_tools.sh go
bash scripts/install_ctf_tools.sh manual
The full package lists now live in scripts/install_ctf_tools.sh.
Each category skill's SKILL.md has a Prerequisites section listing only the tools needed for that category. Install as you go.
Before selecting or escalating a model, read difficulty-routing.md. Use its evidence-based scoring, stop-loss rules, and tier gates throughout the workflow.
If the CTF platform URL is known, check if it runs CTFd and switch to API-driven navigation:
# Detect CTFd (look for /api/v1/ and /themes/core/)
curl -s "$CTF_URL/api/v1/" | head -5
curl -s "$CTF_URL" | grep -oE '/themes/core/'
If CTFd is detected, ask the user for their API token (generated from CTFd Settings > Access Tokens). The token is not provided by default — the user must create one in the CTFd web UI first. Once provided, set the environment variables and proceed via API:
export CTF_URL="https://ctf.example.com"
export CTF_TOKEN="ctfd_..." # Ask user for this
Invoke /ctf-misc and load its ctfd-navigation.md for the full API reference and Python client class.
When the platform is not CTFd, has no usable API, or gates challenges behind a
JS-rendered UI / login, drive the platform in a real browser with Playwright
MCP (https://github.com/microsoft/playwright-mcp). This lets the agent read
challenge text, download attachments, keep a login session, and submit flags
directly through the site.
browser_navigate "https://ctf.example.com/challenges"
browser_snapshot # list challenges, points, categories (rendered)
browser_click <challenge ref> # open a challenge card
browser_snapshot # read description, hints, attachment links
browser_click <attachment ref> # download the challenge file (saved by the browser)
# ... solve the challenge ...
browser_type <flag input ref> "flag{...}"
browser_click <submit ref>
browser_find text="Correct" # cheaper than a full snapshot to check the verdict
browser_find (text or regex over the accessibility tree) is the right tool
whenever you only need to confirm one value — reserve full browser_snapshot
for when you need element refs to click or type into.
Login sessions (cookies/localStorage) persist across tool calls, so authenticate once and every later navigation is authorized. For general browser-automation tooling see ../ctf-web/tools-mcp.md.
Prefer a native API when one exists (CTFd token flow above is faster and more reliable); use Playwright MCP for platforms without an API or when the challenge list only renders client-side.
file * on everythingstrings, xxd | head, binwalk, checksec on binariesnc) to understand what they expectDetermine the primary category, then invoke the matching skill.
By file type:
.pcap, .pcapng, .evtx, .raw, .dd, .E01 -> forensics.elf, .exe, .so, .dll, binary with no extension -> reverse or pwn (check if remote service provided -- if yes, likely pwn).py, .sage, .txt with numbers -> crypto.apk, .wasm, .pyc -> reverse.safetensors, .pt, .pth, .bin, .onnx -> ai-mlBy challenge description keywords:
By service behavior:
Once you identify the category, invoke the matching skill to get specialized techniques:
| Category | Invoke | When to Use |
|---|---|---|
| Web | /ctf-web | XSS, SQLi, SSTI, SSRF, JWT, file uploads, prototype pollution |
| Pwn | /ctf-pwn | Buffer overflow, format string, heap, ROP, sandbox escape |
| Crypto | /ctf-crypto | RSA, AES, ECC, PRNG, ZKP, classical ciphers |
| Reverse | /ctf-reverse | Binary analysis, game clients, VMs, obfuscated code |
| Forensics | /ctf-forensics | Disk images, memory dumps, event logs, stego, network captures |
| OSINT | /ctf-osint | Social media, geolocation, DNS, public records |
| Malware | /ctf-malware | Obfuscated scripts, C2 traffic, PE/.NET analysis |
| AI/ML | /ctf-ai-ml | Model weights (.safetensors, .pt, .pth, .bin, .onnx), prompt injection, LoRA adapters, adversarial examples |
| Misc | /ctf-misc | Jails, encodings, RF/SDR, esoteric languages, constraint solving |
You can also invoke /ctf-<category> to load the full skill instructions with detailed techniques.
If your first approach doesn't work:
Common multi-category patterns:
After solving the challenge, invoke /ctf-writeup to generate a standardized submission-style writeup — concise, reproducible, and ready for competition organizers or teammates to validate.
Flags vary by CTF. Common formats:
flag{...}, FLAG{...}, CTF{...}, TEAM{...}ENO{...}, HTB{...}, picoCTF{...})Validation rule (important):
# Search for common flag patterns in files
grep -rniE '(flag|ctf|eno|htb|pico)\{' .
# Search in binary/memory output
strings output.bin | grep -iE '\{.*\}'
# Recon
file * # Identify file types
strings binary | grep -i flag # Quick string search
xxd binary | head -20 # Hex dump header
binwalk -e firmware.bin # Extract embedded files
checksec --file=binary # Check binary protections
# Connect
nc host port # Connect to challenge
echo -e "answer1\nanswer2" | nc host port # Scripted input
curl -v http://host:port/ # HTTP recon
# Python exploit template
python3 -c "
from pwn import *
r = remote('host', port)
r.interactive()
"
$ARGUMENTS
还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
Investigate AI and machine learning CTF challenges by inspecting model weights, comparing training changes, and exploring adversarial inputs that cause misclassification. Includes references for prompt injection, model reconstruction, and identifying possible training data.
中文简介正在准备中。当前显示英语简介。
Analyze cryptography challenges in CTF security competitions by matching clues to known weaknesses in encryption, signatures, and random number generators. Use technique summaries and supporting code examples to work toward recovering plaintext or keys.
中文简介正在准备中。当前显示英语简介。
Analyze CTF evidence such as disk images, memory dumps, logs, and network captures to recover files and trace activity. Includes techniques for finding hidden data in images, audio, and PDFs, plus hardware signal analysis.
中文简介正在准备中。当前显示英语简介。
Analyze malware in CTF security challenges using techniques for obfuscated scripts, executable files, encrypted traffic, and memory dumps. Follow references to extract configurations, identify command-and-control servers, and find indicators of compromise, such as suspicious domains.
中文简介正在准备中。当前显示英语简介。
Explore CTF puzzles that span categories or use unusual formats, including layered encodings, restricted Python or Bash environments, QR codes, audio signals, and logic games. Provides technique references for decoding clues and solving constraints.
中文简介正在准备中。当前显示英语简介。
Investigate CTF clues through OSINT, research using publicly available information. Use image searches, social profiles, DNS records, and archived pages to identify locations, trace accounts, and connect evidence from multiple public sources.
中文简介正在准备中。当前显示英语简介。