How reverse-skill Resolves Multi-Type CTF Orchestration: A Deep Dive into the Sandbox Routing System

reverse-skill treats every CTF challenge as a sandbox-internal problem and uses a layered routing system to dynamically route tasks from a generic orchestrator to specialized child skills based on dominant evidence types.

The zhaoxuya520/reverse-skill repository implements a sophisticated orchestration framework designed to handle complex Capture The Flag (CTF) competitions involving multiple challenge categories. Unlike static routing systems that require pre-categorized inputs, reverse-skill employs a keyword-driven routing table and evidence-based narrowing to automate the selection of appropriate analysis skills across web, reverse engineering, cryptography, and mobile domains.

The Master Routing Entry Point

Every CTF task enters the system through the primary fast-ladder scripts located at skills/scripts/master-route.ps1 (Windows) or skills/scripts/master-route.sh (Linux/macOS). These scripts serve as the universal entry point for the entire reverse-skill ecosystem.

The master route reads the single source-of-truth routing configuration file skills/config/routing.json to determine which downstream skill should handle the incoming request. This JSON file contains rule definitions that map keyword patterns to specific skill handlers, ensuring declarative and maintainable routing logic.

Triggering the CTF Sandbox Orchestrator (Rule R41)

When processing a CTF-related hint, the routing engine scans the user input against the routes object defined in routing.json. The system activates Rule R41 ("CTF sandbox orchestrator") when the hint contains CTF-specific terms such as ctf, awd, 靶场, or 比赛.题, provided these keywords do not match exclusion patterns for other domains.

Upon matching R41, the router loads CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md, the generic orchestrator for competition tasks. This skill establishes the sandbox model, constructs an initial node map of the challenge environment, and records a minimal evidence path for tracking the analysis state.

Dominant Evidence Detection and Child-Skill Routing

Once the generic CTF orchestrator is active, it initiates dominant evidence detection to narrow the problem scope. The orchestrator consults router-matrix.md (located in CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/references/) to identify the first decisive evidence type—such as a web request, binary crash, or cryptographic boundary.

The matrix maps specific evidence patterns to specialized child skills using a "Route By Dominant Surface" strategy:

• Web vulnerabilities: Routes to $competition-web-runtime or $competition-jwt-claim-confusion when JWT-related tokens are detected
• Binary exploitation: Routes to $competition-reverse-pwn for stack overflows or heap corruption evidence
• Cryptographic challenges: Routes to $competition-crypto-mobile for APKs with certificate pinning or encryption boundaries
• Network protocols: Routes to $competition-websocket-runtime when WebSocket traffic dominates the evidence

Dynamic Re-Routing and Evidence Validation

The orchestrator maintains strict single-active-skill semantics. If the currently executing child skill no longer matches the emerging evidence profile—such as when a web challenge reveals itself to be a client-side reverse engineering task—the orchestrator implements the Re-Route Rules defined in the router matrix.

This fallback mechanism returns control to the top-level sandbox skill, which then selects a new child skill based on the updated dominant evidence. This iterative narrowing guarantees that only one primary child skill remains active at any given time, preventing conflicting analysis states and resource contention.

Evidence-First Reporting

After the specialized child skill completes its focused analysis, the orchestrator aggregates reproducible evidence including file paths, cryptographic hashes, and ticket identifiers. The final report is formatted according to the reporting.md reference specifications, ensuring that all conclusions remain tethered to observable behavior rather than speculative reasoning.

This "evidence priorities" approach, documented in the CTF-Sandbox-Orchestrator skill definition, creates auditable analysis trails required for competitive CTF environments where proof-of-work and reproducibility are critical scoring factors.

Practical Implementation Examples

Invoke the master router with a CTF hint to trigger the automated orchestration pipeline:

# Windows: Invoking the primary router for a web CTF challenge

powershell -NoProfile -ExecutionPolicy Bypass `
    -File skills/scripts/master-route.ps1 `
    -Hint "CTF challenge: a vulnerable web service with a hidden JWT bug"

# Linux/macOS: Processing a reverse engineering challenge

bash skills/scripts/master-route.sh --hint "CTF: reverse-engineer an Android APK with pinning bypass"

Inside the orchestrator, dominant surface selection operates through evidence pattern matching:

# Pseudo-code illustrating the router-matrix logic

if "jwt" in evidence and "kid" in evidence:
    child_skill = "$competition-jwt-claim-confusion"
elif "websocket" in evidence:
    child_skill = "$competition-websocket-runtime"
elif "buffer_overflow" in crash_report:
    child_skill = "$competition-reverse-pwn"

# Load and execute the specialized skill

load_skill(child_skill)

Summary

• reverse-skill uses master-route.ps1 and master-route.sh as universal entry points to read skills/config/routing.json
• Rule R41 in the routing table activates the generic CTF orchestrator located at CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md
• The router-matrix.md reference file drives dominant evidence detection to route tasks to specialized $competition-* child skills
• Dynamic re-routing ensures only one child skill remains active, with automatic fallback when evidence profiles change
• The system enforces evidence-first reporting to maintain reproducible, observable analysis outcomes

Frequently Asked Questions

How does reverse-skill handle CTF challenges that span multiple categories?

The sandbox orchestrator treats multi-type challenges as sequential evidence states. When a task initially appears to be a web challenge but reveals cryptographic protections, the orchestrator detects the shift in dominant evidence via the router-matrix.md rules and re-routes from $competition-web-runtime to $competition-crypto-mobile. This iterative narrowing ensures specialized skills handle only their specific domain expertise while the orchestrator maintains global state.

What is Rule R41 and why is it essential for CTF tasks?

R41 is the routing rule defined in skills/config/routing.json that matches CTF-specific keywords (ctf, awd, 靶场, 比赛.题). It serves as the gateway to the sandbox orchestration system, distinguishing competition environments from standard reverse engineering or malware analysis workflows. Without R41, CTF tasks would route to generic analysis skills lacking the competition-specific reporting and evidence-path requirements.

Can the orchestrator switch child skills multiple times during a single analysis?

Yes, the Re-Route Rules explicitly support multiple skill transitions. If the dominant evidence changes—for example, moving from JWT analysis to WebSocket protocol analysis—the orchestrator returns to the top-level sandbox skill and selects a new child skill. This guarantees that at any moment, exactly one primary child skill is active, preventing analysis conflicts while allowing flexible multi-stage investigations.

Where does reverse-skill store the evidence collected during CTF orchestration?

Evidence is recorded in the sandbox model established by the generic orchestrator, with specific paths, hashes, and tickets stored according to the reporting.md reference specifications. The orchestrator maintains a minimal evidence path throughout the routing process, ensuring that when child skills like $competition-reverse-pwn or $competition-web-runtime complete their analysis, all artifacts remain traceable to their original sandbox context.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}