# How reverse-skill Resolves Multi-Type CTF Orchestration: A Deep Dive into the Sandbox Routing System

> Learn how reverse-skill solves multi-type CTF orchestration with its layered sandbox routing system. Discover dynamic task routing to specialized child skills.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-27

---

**reverse-skill treats every CTF challenge as a sandbox-internal problem and uses a layered routing system to dynamically route tasks from a generic orchestrator to specialized child skills based on dominant evidence types.**

The `zhaoxuya520/reverse-skill` repository implements a sophisticated orchestration framework designed to handle complex Capture The Flag (CTF) competitions involving multiple challenge categories. Unlike static routing systems that require pre-categorized inputs, reverse-skill employs a keyword-driven routing table and evidence-based narrowing to automate the selection of appropriate analysis skills across web, reverse engineering, cryptography, and mobile domains.

## The Master Routing Entry Point

Every CTF task enters the system through the primary fast-ladder scripts located at `skills/scripts/master-route.ps1` (Windows) or [`skills/scripts/master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/master-route.sh) (Linux/macOS). These scripts serve as the universal entry point for the entire reverse-skill ecosystem.

The master route reads the single source-of-truth routing configuration file **[`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json)** to determine which downstream skill should handle the incoming request. This JSON file contains rule definitions that map keyword patterns to specific skill handlers, ensuring declarative and maintainable routing logic.

## Triggering the CTF Sandbox Orchestrator (Rule R41)

When processing a CTF-related hint, the routing engine scans the user input against the `routes` object defined in [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json). The system activates Rule **R41** ("CTF sandbox orchestrator") when the hint contains CTF-specific terms such as `ctf`, `awd`, `靶场`, or `比赛.题`, provided these keywords do not match exclusion patterns for other domains.

Upon matching R41, the router loads **[`CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md)**, the generic orchestrator for competition tasks. This skill establishes the sandbox model, constructs an initial node map of the challenge environment, and records a minimal evidence path for tracking the analysis state.

## Dominant Evidence Detection and Child-Skill Routing

Once the generic CTF orchestrator is active, it initiates **dominant evidence detection** to narrow the problem scope. The orchestrator consults **[`router-matrix.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/router-matrix.md)** (located in `CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/references/`) to identify the first decisive evidence type—such as a web request, binary crash, or cryptographic boundary.

The matrix maps specific evidence patterns to specialized child skills using a "Route By Dominant Surface" strategy:

- **Web vulnerabilities**: Routes to `$competition-web-runtime` or `$competition-jwt-claim-confusion` when JWT-related tokens are detected
- **Binary exploitation**: Routes to `$competition-reverse-pwn` for stack overflows or heap corruption evidence  
- **Cryptographic challenges**: Routes to `$competition-crypto-mobile` for APKs with certificate pinning or encryption boundaries
- **Network protocols**: Routes to `$competition-websocket-runtime` when WebSocket traffic dominates the evidence

## Dynamic Re-Routing and Evidence Validation

The orchestrator maintains strict **single-active-skill** semantics. If the currently executing child skill no longer matches the emerging evidence profile—such as when a web challenge reveals itself to be a client-side reverse engineering task—the orchestrator implements the **Re-Route Rules** defined in the router matrix.

This fallback mechanism returns control to the top-level sandbox skill, which then selects a new child skill based on the updated dominant evidence. This iterative narrowing guarantees that only one primary child skill remains active at any given time, preventing conflicting analysis states and resource contention.

## Evidence-First Reporting

After the specialized child skill completes its focused analysis, the orchestrator aggregates reproducible evidence including file paths, cryptographic hashes, and ticket identifiers. The final report is formatted according to the [`reporting.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/reporting.md) reference specifications, ensuring that all conclusions remain tethered to observable behavior rather than speculative reasoning.

This "evidence priorities" approach, documented in the CTF-Sandbox-Orchestrator skill definition, creates auditable analysis trails required for competitive CTF environments where proof-of-work and reproducibility are critical scoring factors.

## Practical Implementation Examples

Invoke the master router with a CTF hint to trigger the automated orchestration pipeline:

```powershell

# Windows: Invoking the primary router for a web CTF challenge

powershell -NoProfile -ExecutionPolicy Bypass `
    -File skills/scripts/master-route.ps1 `
    -Hint "CTF challenge: a vulnerable web service with a hidden JWT bug"

```

```bash

# Linux/macOS: Processing a reverse engineering challenge

bash skills/scripts/master-route.sh --hint "CTF: reverse-engineer an Android APK with pinning bypass"

```

Inside the orchestrator, dominant surface selection operates through evidence pattern matching:

```python

# Pseudo-code illustrating the router-matrix logic

if "jwt" in evidence and "kid" in evidence:
    child_skill = "$competition-jwt-claim-confusion"
elif "websocket" in evidence:
    child_skill = "$competition-websocket-runtime"
elif "buffer_overflow" in crash_report:
    child_skill = "$competition-reverse-pwn"

# Load and execute the specialized skill

load_skill(child_skill)

```

## Summary

- **reverse-skill** uses `master-route.ps1` and [`master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/master-route.sh) as universal entry points to read [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json)
- Rule **R41** in the routing table activates the generic CTF orchestrator located at [`CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md)
- The **router-matrix.md** reference file drives dominant evidence detection to route tasks to specialized `$competition-*` child skills
- **Dynamic re-routing** ensures only one child skill remains active, with automatic fallback when evidence profiles change
- The system enforces **evidence-first reporting** to maintain reproducible, observable analysis outcomes

## Frequently Asked Questions

### How does reverse-skill handle CTF challenges that span multiple categories?

The **sandbox orchestrator** treats multi-type challenges as sequential evidence states. When a task initially appears to be a web challenge but reveals cryptographic protections, the orchestrator detects the shift in dominant evidence via the router-matrix.md rules and re-routes from `$competition-web-runtime` to `$competition-crypto-mobile`. This iterative narrowing ensures specialized skills handle only their specific domain expertise while the orchestrator maintains global state.

### What is Rule R41 and why is it essential for CTF tasks?

**R41** is the routing rule defined in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) that matches CTF-specific keywords (`ctf`, `awd`, `靶场`, `比赛.题`). It serves as the gateway to the sandbox orchestration system, distinguishing competition environments from standard reverse engineering or malware analysis workflows. Without R41, CTF tasks would route to generic analysis skills lacking the competition-specific reporting and evidence-path requirements.

### Can the orchestrator switch child skills multiple times during a single analysis?

Yes, the **Re-Route Rules** explicitly support multiple skill transitions. If the dominant evidence changes—for example, moving from JWT analysis to WebSocket protocol analysis—the orchestrator returns to the top-level sandbox skill and selects a new child skill. This guarantees that at any moment, exactly one primary child skill is active, preventing analysis conflicts while allowing flexible multi-stage investigations.

### Where does reverse-skill store the evidence collected during CTF orchestration?

Evidence is recorded in the **sandbox model** established by the generic orchestrator, with specific paths, hashes, and tickets stored according to the [`reporting.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/reporting.md) reference specifications. The orchestrator maintains a minimal evidence path throughout the routing process, ensuring that when child skills like `$competition-reverse-pwn` or `$competition-web-runtime` complete their analysis, all artifacts remain traceable to their original sandbox context.