How the CTF-Sandbox-Orchestrator Coordinates 42 Sub-Skills for Competition Scenarios

The CTF-Sandbox-Orchestrator acts as a central master router that instantiates sandbox cases, extracts decisive evidence, and dispatches tasks to one of 42 specialized competition sub-skills through a declarative router matrix.

In the zhaoxuya520/reverse-skill repository, the CTF-Sandbox-Orchestrator serves as the primary entry point for all CTF competition workflows. It implements an evidence-driven coordination model where a single orchestrator manages downstream specialized skills without allowing them to initiate cases independently.

Architecture of the CTF-Sandbox-Orchestrator

The orchestrator operates as a gatekeeper that maintains the canonical sandbox model while delegating domain-specific analysis to child skills.

The Router Matrix

At the core of the coordination logic lies the router matrix defined in CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/references/router-matrix.md. This declarative table maps dominant evidence types—such as Web APIs, encrypted ZIP archives, or Kerberos tickets—to specific child skill names prefixed with $competition-.

The matrix enforces a single-active-child policy. When a sub-skill exhausts its domain or encounters evidence outside its scope, it returns an un-route signal to the orchestrator. The orchestrator then re-evaluates the matrix with updated evidence and selects a new downstream skill, ensuring deterministic workflow progression.

The 42 Competition Sub-Skills

Each of the 42 sub-skills resides in a dedicated CTF-Sandbox-Orchestrator/competition-* directory containing a SKILL.md file. These downstream-only modules inherit the sandbox context through the $ctf-sandbox-orchestrator variable and perform specialized analysis across categories including:

• Web & Runtime: $competition-web-runtime, $competition-websocket-runtime, $competition-template-render-path
• Cryptography & Archives: $competition-zip-archive, $competition-crypto-mobile
• Reverse Engineering: $competition-reverse-pwn, $competition-malware-config
• Identity & Windows: $competition-kerberos-delegation, $competition-dpapi-credential-chain
• Cloud & Containers: $competition-k8s-control-plane, $competition-container-runtime

Step-by-Step Coordination Workflow

The orchestrator follows a strict evidence-collection and dispatch loop:

1. Sandbox Initialization: When a user invokes the primary ctf-sandbox/ skill, the orchestrator creates a case work-area at work/<case>/ containing scope.md and timeline.md.

2. Evidence Capture: The orchestrator extracts the first decisive evidence—such as file hashes, JWT headers, or network captures—and records it in the sandbox model.

3. Matrix Consultation: Using the captured evidence, the orchestrator queries the router matrix to match the "Dominant Surface" category. For example, an encrypted ZIP file triggers the $competition-zip-archive mapping.

4. Downstream Dispatch: The orchestrator invokes the selected child skill's SKILL.md as a downstream module, passing the sandbox context and case directory.

5. Evidence Production: The child skill performs domain-specific analysis—such as running bkcrack for ZipCrypto recovery—and generates new evidence or flags.

6. Re-Routing Decision: If the child skill encounters a blocker outside its domain, it signals the orchestrator to re-evaluate. The orchestrator consults the matrix again with the latest evidence, potentially dispatching a different sub-skill.

7. Terminal Condition: The loop terminates when the workflow reaches a defined end state: flag obtained, exploit succeeded, or evidence exhaustion.

Evidence-Driven Routing in Action

Consider a scenario involving an encrypted ZIP challenge. The orchestrator automatically coordinates the workflow without manual intervention:

# Primary invocation

skill: ctf-sandbox/
hint: "solve the encrypted zip challenge attached as challenge.zip"

Upon detecting the ZIP file, the orchestrator executes the following coordination sequence:

# 1. Evidence capture (performed by orchestrator)

sha256sum challenge.zip
bkcrack -L challenge.zip

# 2. Router matrix matches "Legacy ZipCrypto" 

#    → Dispatches $competition-zip-archive

# 3. Downstream skill executes known-plaintext attack

bkcrack -C challenge.zip -p plaintext.txt -o cracked.zip

If the ZIP uses AES encryption instead of legacy ZipCrypto, the $competition-zip-archive skill returns a re-route signal. The orchestrator then re-consults router-matrix.md and may fallback to $competition-crypto-mobile or a generic cryptography skill.

Key Implementation Files

The coordination mechanism relies on these critical files in the zhaoxuya520/reverse-skill repository:

• CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md – Master orchestrator defining sandbox initialization and primary routing logic.
• CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/references/router-matrix.md – Declarative decision table mapping evidence types to the 42 sub-skills.
• CTF-Sandbox-Orchestrator/competition-zip-archive/SKILL.md – Example downstream skill implementing ZipCrypto analysis with bkcrack integration.
• skills/MASTER-ROUTING.md – Entry point that routes "CTF" hints to the orchestrator.
• skills/routing.md – Full routing matrix including the orchestrator as the CTF branch.

Summary

The CTF-Sandbox-Orchestrator implements a deterministic coordination model for competition scenarios:

• Creates isolated sandbox cases with structured evidence tracking in work/<case>/.
• Consults a declarative router matrix to map evidence to one of 42 specialized sub-skills.
• Maintains single-active-child execution, preventing concurrent skill conflicts.
• Supports re-routing loops when child skills encounter out-of-scope blockers.
• Preserves workflow context through the $ctf-sandbox-orchestrator variable across all downstream operations.

Frequently Asked Questions

How does the CTF-Sandbox-Orchestrator choose which sub-skill to execute?

The orchestrator extracts the first decisive evidence from the challenge input and consults the router matrix in references/router-matrix.md. This declarative table maps dominant evidence types—such as encrypted archives, network protocols, or authentication tokens—to specific $competition-* sub-skills. The first matching pattern determines the downstream dispatch target.

Can multiple competition sub-skills run simultaneously?

No. The architecture enforces a single-active-child policy where only one sub-skill executes at a time. If a skill encounters evidence outside its domain, it returns control to the orchestrator through a re-route signal. The orchestrator then re-evaluates the matrix and may dispatch a different skill, but concurrent execution of multiple competition sub-skills is prohibited by design.

What happens if a sub-skill cannot solve its assigned challenge?

When a sub-skill exhausts its analytical capabilities or hits a domain boundary, it signals the orchestrator to re-route. The orchestrator captures any new evidence generated during the attempt, updates the sandbox model, and re-consults the router matrix. This iterative process continues until a matching skill succeeds or all evidence paths are exhausted.

Where are the 42 sub-skills defined in the repository?

Each sub-skill resides in a separate directory under CTF-Sandbox-Orchestrator/ with the naming convention competition-<category>/. Every directory contains a SKILL.md file defining the skill's workflow, evidence requirements, and re-routing conditions. The README.md at the repository root confirms the presence of 42 distinct competition sub-skills under the orchestrator's management.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}