How CTF Sandbox Orchestrator Sub-Skills Integrate with the Main Router

The CTF Sandbox Orchestrator integrates with the main router through a two-tiered routing system where master-route.sh selects the orchestrator based on keyword patterns in skills/config/routing.json, and the orchestrator then internally routes to specific competition sub-skills using its declarative router-matrix.md based on runtime evidence.

The zhaoxuya520/reverse-skill repository implements a hierarchical routing architecture that separates high-level intent classification from domain-specific skill dispatch. Understanding how CTF sandbox orchestrator sub-skills integrate with the main router reveals a modular design that prioritizes runtime evidence over static configuration.

Master Router Selection Logic

The main router (skills/scripts/master-route.sh or master-route.ps1) serves as the entry point for all task routing. It maintains a single source of truth in skills/config/routing.json, which maps keyword patterns to primary skill identifiers.

Routing Table Configuration

The routing table defines the CTF Sandbox Orchestrator as entry R41 with specific inclusion and exclusion patterns:

"R41": {
  "label": "CTF sandbox orchestrator",
  "skill": "ctf-sandbox/SKILL.md",
  "keywords": [
    { "must": "\\bctf\\b|awd|靶场|比赛.?题", "exclude": "pwn|rop|栈溢出|堆溢出|ret2" }
  ]
}

This configuration ensures that hints containing CTF-related terms (including Chinese characters for "靶场" or competition patterns) trigger the orchestrator, while excluding specific exploit categories that might belong to other skills.

Keyword Matching and Priority

When processing a user hint, master-route.sh evaluates the must regex against the input while ensuring the exclude pattern does not match. Upon successful validation, the router writes a route-scope file that records ctf-sandbox/SKILL.md as the active primary skill, effectively handing control to the orchestrator context.

Orchestrator Activation and Internal Routing

Once selected, the orchestrator acts as a domain-specific controller that manages child competition skills through an internal routing matrix.

Loading the Skill Definition

The main router loads CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md, which defines the orchestrator's workflow and evidence evaluation priorities. This skill file references a specialized routing matrix that maps observable evidence types to specific sub-skill identifiers.

The Router Matrix Decision Engine

The orchestrator consults references/router-matrix.md to determine which competition sub-skill best matches the current evidence. Unlike the main router's keyword-based approach, this matrix operates on observable runtime evidence such as HTTP requests, binary crashes, or authentication tokens:

### Web And Runtime

- General site, API, auth, … -> $competition-web-runtime
- Browser storage, … -> $competition-browser-persistence

Each entry maps a dominant evidence type to a variable-style sub-skill reference (e.g., $competition-web-runtime) that the orchestrator resolves to actual skill file paths.

Sub-Skill Routing and Evidence-Based Hand-off

The integration relies on an evidence-first design that ensures only one child skill remains active at any given moment, preserving a clear chain of custody for the task.

Evidence-First Evaluation

The orchestrator analyzes current runtime evidence against its Evidence Priorities list defined in SKILL.md. When conflicts arise between multiple potential sub-skills, the orchestrator selects the handler matching the highest-priority evidence source. This approach prevents the main router from needing to understand CTF-specific technical details, delegating that expertise to the orchestrator's domain model.

Re-Routing Rules and Scope Management

If the dominant blocker changes during execution—such as shifting from a web vulnerability to a binary exploit—the orchestrator implements re-routing logic that returns control to the orchestrator context and selects a different child skill:

# Re-Route Rules from router-matrix.md

- If the current child skill stops matching the dominant blocker,
  return to `ctf-sandbox-orchestrator` and pick a narrower path.

This mechanism ensures that sub-skills do not directly invoke siblings; instead, the orchestrator maintains centralized routing authority, reloading alternative competition skill definitions (e.g., competition-reverse-pwn/SKILL.md) as evidence demands.

Code Implementation Examples

The following examples demonstrate the technical implementation of this two-tiered routing system.

Main router selection logic in skills/scripts/master-route.sh:

# Part of the routing loop

if [[ "$hint" =~ $must_regex && ! "$hint" =~ $exclude_regex ]]; then
  primary="R41"          # CTF sandbox orchestrator

  skill_path="ctf-sandbox/SKILL.md"
fi

# Write route-scope.md with '- primary: $primary'

Declarative routing matrix in references/router-matrix.md:

### Web And Runtime

- General site, API, auth, … -> $competition-web-runtime
- Browser storage, … -> $competition-browser-persistence

Conceptual orchestrator internal routing:

# Pseudocode representing orchestrator behavior

evidence = detect_evidence()               # e.g., parse HTTP request or crash dump

target_skill = router_matrix.lookup(evidence)
load_skill(target_skill)                   # e.g., load competition-web-runtime/SKILL.md

Summary

• The main router (master-route.sh) selects the CTF Sandbox Orchestrator (R41) from skills/config/routing.json when hints match CTF-specific keyword patterns.
• The orchestrator acts as a secondary router, using references/router-matrix.md to map runtime evidence to specific competition sub-skills.
• Evidence-first design ensures the orchestrator routes to child skills based on observable technical indicators rather than initial user hints.
• Re-routing rules allow the orchestrator to switch between sub-skills dynamically when the dominant evidence type changes, maintaining a single active skill at all times.
• This architecture keeps the main router generic while allowing CTF-specific routing logic to evolve independently within the orchestrator's domain.

Frequently Asked Questions

What triggers the main router to select the CTF Sandbox Orchestrator?

The main router evaluates user hints against the regex pattern \bctf\b|awd|靶场|比赛.?题 defined in skills/config/routing.json under the R41 entry. If the hint matches the must pattern and does not match the exclusion pattern (pwn|rop|栈溢出|堆溢出|ret2), the router selects the orchestrator as the primary skill and writes the selection to the route-scope file.

How does the orchestrator decide which competition sub-skill to activate?

The orchestrator consults its internal references/router-matrix.md, which maps dominant evidence types (such as web APIs, binary crashes, or JWT tokens) to specific sub-skill identifiers like $competition-web-runtime or $competition-reverse-pwn. It selects the first matching entry based on its Evidence Priorities list.

What happens when the current sub-skill no longer matches the evidence?

When the dominant blocker changes, the orchestrator re-routes according to rules defined in router-matrix.md. It returns control to the orchestrator context and selects a different child skill that matches the new evidence type. This ensures only one competition sub-skill remains active at any moment, preserving evidence chain integrity.

Where is the routing configuration defined in the repository?

The master routing table resides in skills/config/routing.json, while the CTF-specific sub-skill mappings are defined in CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/references/router-matrix.md. The orchestrator's behavior and evidence priorities are documented in CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}