# How the CTF-Sandbox-Orchestrator Coordinates 42 Sub-Skills for Competition Scenarios

> Discover how the CTF-Sandbox-Orchestrator coordinates 42 sub-skills. It routes tasks, instantiates sandboxes, and extracts evidence for competition scenarios.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-28

---

**The CTF-Sandbox-Orchestrator acts as a central master router that instantiates sandbox cases, extracts decisive evidence, and dispatches tasks to one of 42 specialized competition sub-skills through a declarative router matrix.**

In the `zhaoxuya520/reverse-skill` repository, the **CTF-Sandbox-Orchestrator** serves as the primary entry point for all CTF competition workflows. It implements an evidence-driven coordination model where a single orchestrator manages downstream specialized skills without allowing them to initiate cases independently.

## Architecture of the CTF-Sandbox-Orchestrator

The orchestrator operates as a **gatekeeper** that maintains the canonical sandbox model while delegating domain-specific analysis to child skills.

### The Router Matrix

At the core of the coordination logic lies the **router matrix** defined in [`CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/references/router-matrix.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/references/router-matrix.md). This declarative table maps *dominant evidence types*—such as Web APIs, encrypted ZIP archives, or Kerberos tickets—to specific child skill names prefixed with `$competition-`.

The matrix enforces a **single-active-child policy**. When a sub-skill exhausts its domain or encounters evidence outside its scope, it returns an *un-route* signal to the orchestrator. The orchestrator then re-evaluates the matrix with updated evidence and selects a new downstream skill, ensuring deterministic workflow progression.

### The 42 Competition Sub-Skills

Each of the **42 sub-skills** resides in a dedicated `CTF-Sandbox-Orchestrator/competition-*` directory containing a [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) file. These downstream-only modules inherit the sandbox context through the `$ctf-sandbox-orchestrator` variable and perform specialized analysis across categories including:

- **Web & Runtime**: `$competition-web-runtime`, `$competition-websocket-runtime`, `$competition-template-render-path`
- **Cryptography & Archives**: `$competition-zip-archive`, `$competition-crypto-mobile`
- **Reverse Engineering**: `$competition-reverse-pwn`, `$competition-malware-config`
- **Identity & Windows**: `$competition-kerberos-delegation`, `$competition-dpapi-credential-chain`
- **Cloud & Containers**: `$competition-k8s-control-plane`, `$competition-container-runtime`

## Step-by-Step Coordination Workflow

The orchestrator follows a strict evidence-collection and dispatch loop:

1. **Sandbox Initialization**: When a user invokes the primary `ctf-sandbox/` skill, the orchestrator creates a case work-area at `work/<case>/` containing [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) and [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md).

2. **Evidence Capture**: The orchestrator extracts the first decisive evidence—such as file hashes, JWT headers, or network captures—and records it in the sandbox model.

3. **Matrix Consultation**: Using the captured evidence, the orchestrator queries the router matrix to match the "Dominant Surface" category. For example, an encrypted ZIP file triggers the `$competition-zip-archive` mapping.

4. **Downstream Dispatch**: The orchestrator invokes the selected child skill's [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) as a downstream module, passing the sandbox context and case directory.

5. **Evidence Production**: The child skill performs domain-specific analysis—such as running `bkcrack` for ZipCrypto recovery—and generates new evidence or flags.

6. **Re-Routing Decision**: If the child skill encounters a blocker outside its domain, it signals the orchestrator to re-evaluate. The orchestrator consults the matrix again with the latest evidence, potentially dispatching a different sub-skill.

7. **Terminal Condition**: The loop terminates when the workflow reaches a defined end state: flag obtained, exploit succeeded, or evidence exhaustion.

## Evidence-Driven Routing in Action

Consider a scenario involving an encrypted ZIP challenge. The orchestrator automatically coordinates the workflow without manual intervention:

```yaml

# Primary invocation

skill: ctf-sandbox/
hint: "solve the encrypted zip challenge attached as challenge.zip"

```

Upon detecting the ZIP file, the orchestrator executes the following coordination sequence:

```bash

# 1. Evidence capture (performed by orchestrator)

sha256sum challenge.zip
bkcrack -L challenge.zip

# 2. Router matrix matches "Legacy ZipCrypto" 

#    → Dispatches $competition-zip-archive

# 3. Downstream skill executes known-plaintext attack

bkcrack -C challenge.zip -p plaintext.txt -o cracked.zip

```

If the ZIP uses AES encryption instead of legacy ZipCrypto, the `$competition-zip-archive` skill returns a re-route signal. The orchestrator then re-consults [`router-matrix.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/router-matrix.md) and may fallback to `$competition-crypto-mobile` or a generic cryptography skill.

## Key Implementation Files

The coordination mechanism relies on these critical files in the `zhaoxuya520/reverse-skill` repository:

- **[`CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md)** – Master orchestrator defining sandbox initialization and primary routing logic.
- **[`CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/references/router-matrix.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/references/router-matrix.md)** – Declarative decision table mapping evidence types to the 42 sub-skills.
- **[`CTF-Sandbox-Orchestrator/competition-zip-archive/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/CTF-Sandbox-Orchestrator/competition-zip-archive/SKILL.md)** – Example downstream skill implementing ZipCrypto analysis with `bkcrack` integration.
- **[`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md)** – Entry point that routes "CTF" hints to the orchestrator.
- **[`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md)** – Full routing matrix including the orchestrator as the CTF branch.

## Summary

The **CTF-Sandbox-Orchestrator** implements a deterministic coordination model for competition scenarios:

- Creates isolated sandbox cases with structured evidence tracking in `work/<case>/`.
- Consults a declarative **router matrix** to map evidence to one of **42 specialized sub-skills**.
- Maintains **single-active-child** execution, preventing concurrent skill conflicts.
- Supports **re-routing loops** when child skills encounter out-of-scope blockers.
- Preserves workflow context through the `$ctf-sandbox-orchestrator` variable across all downstream operations.

## Frequently Asked Questions

### How does the CTF-Sandbox-Orchestrator choose which sub-skill to execute?

The orchestrator extracts the first decisive evidence from the challenge input and consults the **router matrix** in [`references/router-matrix.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/router-matrix.md). This declarative table maps dominant evidence types—such as encrypted archives, network protocols, or authentication tokens—to specific `$competition-*` sub-skills. The first matching pattern determines the downstream dispatch target.

### Can multiple competition sub-skills run simultaneously?

No. The architecture enforces a **single-active-child policy** where only one sub-skill executes at a time. If a skill encounters evidence outside its domain, it returns control to the orchestrator through a re-route signal. The orchestrator then re-evaluates the matrix and may dispatch a different skill, but concurrent execution of multiple competition sub-skills is prohibited by design.

### What happens if a sub-skill cannot solve its assigned challenge?

When a sub-skill exhausts its analytical capabilities or hits a domain boundary, it signals the orchestrator to **re-route**. The orchestrator captures any new evidence generated during the attempt, updates the sandbox model, and re-consults the router matrix. This iterative process continues until a matching skill succeeds or all evidence paths are exhausted.

### Where are the 42 sub-skills defined in the repository?

Each sub-skill resides in a separate directory under `CTF-Sandbox-Orchestrator/` with the naming convention `competition-<category>/`. Every directory contains a [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) file defining the skill's workflow, evidence requirements, and re-routing conditions. The [`README.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/README.md) at the repository root confirms the presence of **42 distinct competition sub-skills** under the orchestrator's management.