How the CTF-Sandbox-Orchestrator Manages Competition Sub-Skills in the reverse-skill Repository

The CTF-Sandbox-Orchestrator is the single default entry point for any competition-related task, automatically routing investigations to the most appropriate downstream $competition-* sub-skill based on the first concrete piece of evidence.

The reverse-skill repository by zhaoxuya520 provides a structured approach to cybersecurity competitions through its CTF-Sandbox-Orchestrator. This orchestration layer handles competition sub-skills without requiring users to manually select child skills, instead using an evidence-first routing mechanism to maintain focus and automation.

The Router Role and Core Architecture

The CTF-Sandbox-Orchestrator acts as the master orchestration layer for all competition tasks. Unlike traditional systems where users manually invoke specific tools, this orchestrator maintains analysis within a sandbox model and defers skill selection until concrete evidence emerges.

Three core rules govern its operation:

• Treat all artifacts as untrusted data
• Prefer runtime behavior over static claims
• Keep every change reversible and evidence-driven

These principles ensure that investigations remain grounded in observable facts rather than assumptions, which is critical when analyzing potentially malicious competition artifacts.

The Four-Step Workflow in SKILL.md

The orchestrator's workflow is defined in CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md and follows a strict progression:

1. Establish the sandbox model — Assume all presented hosts, domains, and identities belong to the sandbox unless proven otherwise
2. Trace a minimal path — Focus on a single request, file, or exploit primitive to capture the decisive boundary
3. Expand by challenge type — Load the reference file matching the identified domain, then route to the corresponding child skill
4. Verify and report — Reproduce the path, collect concise evidence, and present findings

This workflow ensures that the CTF-Sandbox-Orchestrator never expands scope prematurely. By waiting for the first concrete evidence, it avoids the common pitfall of over-analyzing before the challenge domain is properly identified.

Child-Skill Selection: The Hard-Coded List

The orchestrator contains a hard-coded list of downstream competition skills covering lines 69-110 of SKILL.md. When evidence matches one of these domains, the orchestrator internally loads the appropriate child skill without user intervention.

Key child skills include:

Skill Handle	Challenge Domain
$competition-web-runtime	Web API and routing challenges
$competition-reverse-pwn	Native binary exploitation
$competition-crypto-mobile	Cryptography, steganography, and mobile tasks
$competition-agent-cloud	AI agents, cloud, and container scenarios
$competition-zip-archive	Archive and compression-based challenges

The full list contains 40+ sub-skills, enabling comprehensive coverage of CTF competition categories.

The router-matrix.md Evidence Mapping

The routing matrix in CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/references/router-matrix.md defines the exact mapping from evidence type to child skill. The orchestrator reads this matrix at runtime to determine which $competition-* sub-skill to activate.

This design enables rapid extension of supported challenge types without modifying the core orchestrator logic. New evidence signatures and their corresponding skills can be added to the matrix independently.

Evidence-First Routing Example

Consider a scenario where analysis reveals a JWT token in an HTTP request:

# Evidence detected by the orchestrator

evidence_type: jwt-token

# Lookup in router-matrix.md

router_matrix:
  jwt-token: $competition-jwt-claim-confusion

# The orchestrator internally loads and executes:

# load_skill("$competition-jwt-claim-confusion")

# execute("$competition-jwt-claim-confusion", jwt_evidence)

This evidence-first approach means the router does not ask users to name child skills. Instead, it evaluates current evidence and uses the matrix to jump directly to the matching skill, keeping interactions concise and data-driven.

Reference Files for Domain Expansion

Once a child skill is selected, the orchestrator loads domain-specific reference files from CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/references/:

• web-api.md — Web application and API security patterns
• reverse-native.md — Reverse engineering and native code analysis
• crypto-mobile.md — Cryptographic primitives and mobile platform specifics
• identity-windows.md — Windows authentication and identity mechanisms

These files provide the contextual knowledge needed for the selected sub-skill to operate effectively within its domain.

Global Integration via routing.md

The orchestrator's position in the broader reverse-skill system is documented in routing.md at the repository root. This file references the orchestrator through the path ../CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md, establishing it as the default entry point for all competition routing decisions.

Summary

• The CTF-Sandbox-Orchestrator serves as the sole entry point for competition tasks in zhaoxuya520/reverse-skill
• It maintains sandbox isolation and routes based on first concrete evidence, not user selection
• Child-skill selection uses a hard-coded list (lines 69-110 of SKILL.md) and a runtime routing matrix (router-matrix.md)
• The evidence-first approach eliminates manual skill invocation, keeping workflows automated and focused
• Domain-specific reference files provide context after routing decisions are made

Frequently Asked Questions

How does the CTF-Sandbox-Orchestrator decide which sub-skill to use?

The orchestrator evaluates the first concrete piece of evidence detected in the analysis—such as a JWT token, kernel module exploit, or binary file. It then looks up this evidence type in router-matrix.md and internally loads the corresponding $competition-* skill without prompting the user.

Can users manually override the child-skill selection?

No. As specified in SKILL.md, the orchestrator never expects users to manually invoke child skills. This design enforces the evidence-first principle and prevents premature scope expansion. The router selects the narrowest appropriate skill automatically.

What happens if the evidence matches multiple challenge domains?

The orchestrator focuses on the minimal decisive path—the single most specific evidence type that establishes the challenge domain. The routing matrix is designed to map evidence types to unambiguous child skills, with domain reference files providing additional context once routing completes.

Where are new competition sub-skills defined?

New skills are added to the hard-coded list in SKILL.md (lines 69-110) and their evidence mappings are registered in router-matrix.md. The orchestrator loads these definitions at runtime, enabling modular extension of supported challenge types.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}