Setting up the CTF-Sandbox-Orchestrator for Competitive Security Challenge Workflows

Configure the CTF-Sandbox-Orchestrator by initializing the routing layer, bootstrapping required tools via bootstrap-manifest.json, and invoking master-route.ps1 or master-route.sh to automate competitive security challenge workflows across Windows and Kali Linux environments.

The CTF-Sandbox-Orchestrator is a specialized skill module within the zhaoxuya520/reverse-skill repository that orchestrates AI-driven workflows for capture-the-flag competitions and penetration testing scenarios. As part of a platform-neutral skill router architecture, it leverages a centralized routing manifest and automated tool discovery to execute 40+ CTF-specific sub-skills without manual configuration. This guide walks through the complete setup process using the actual source implementation, from bootstrap to regression testing.

Understanding the CTF-Sandbox-Orchestrator Architecture

The orchestrator operates within the reverse-skill routing layer, which determines which security workflow to execute based on task characteristics. The architecture separates concerns between routing logic, tool management, and evidence collection.

Routing Layer and Configuration

The single source of truth for all routing decisions resides in skills/config/routing.json, which contains 41 machine-readable rules mapping task hints to specific skill implementations. For the CTF-Sandbox-Orchestrator specifically, the system references CTF-Sandbox-Orchestrator/ directory containing 40+ specialized sub-skills for competitive challenges.

Key routing files include:

• skills/config/routing.json – Machine-readable routing matrix (41 rules)
• skills/routing.md – Human-readable routing documentation
• skills/MASTER-ROUTING.md – Fast-track routing ladder for common workflows
• CTF-Sandbox-Orchestrator/SKILL.md – Skill-specific entry point with front-matter metadata

When a request targets competitive security challenges, the router parses these configuration files to identify the appropriate sub-skill (e.g., sandbox escape, binary exploitation, or forensics workflows).

Tool Discovery and Bootstrap Process

Before executing any CTF workflow, the orchestrator validates tool availability through the Tool Discovery layer. Located at skills/scripts/ToolDiscovery.ps1 (Windows) and kali/scripts/ToolDiscovery.sh (Kali Linux), these scripts check the environment against skills/tool-index.md and trigger automatic installation via bootstrap-manifest.json.

The bootstrap manifest supports multiple package managers:

• Windows: winget, pip, npm, GitHub ZIP extraction
• Linux: apt, pip, direct repository clones

This ensures idempotent setup across different CTF environments without manual dependency resolution.

Prerequisites and Initial Setup

Begin by refreshing the tool index to establish baseline capabilities on your platform.

Refresh Tool Detection

Run the platform-appropriate script to scan installed security tools and update the central index:

# Linux / Kali Linux

bash skills/scripts/refresh-tool-index.sh

# Windows PowerShell

powershell -File skills/scripts/refresh-tool-index.ps1

This updates skills/tool-index.md with detected capabilities, enabling the orchestrator to skip installation steps for existing tools like GDB, Ghidra, or Burp Suite.

Verify Bootstrap Configuration

Inspect bootstrap-manifest.json to confirm platform-specific installer definitions. This file maps tool names to installation commands, ensuring the CTF-Sandbox-Orchestrator can auto-install missing dependencies such as:

• Container runtime (Docker/Podman) for sandboxed challenges
• Binary analysis suites (radare2, Cutter, IDA Free)
• Network reconnaissance tools (nmap, masscan, ffuf)

Configuring the Routing Rules

To integrate custom CTF workflows, you must register them in the routing configuration and verify coherence with the existing 41-rule matrix.

Registering CTF Sub-Skills

Each sub-skill within CTF-Sandbox-Orchestrator/ requires a SKILL.md file containing front-matter metadata that defines:

• Trigger patterns: Keywords that map requests to this skill
• Required tools: Dependencies checked against tool-index.md
• Evidence paths: Output directories for challenge artifacts

After creating or modifying a sub-skill, update the navigation index:

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/extract-summaries.ps1

This regenerates the master index ensuring AI agents can discover new CTF capabilities.

Validate Routing Coherence

Before deploying in competitive environments, verify that routing changes do not break existing workflows:

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/verify-routing-coherence.ps1

This script checks for circular dependencies, missing skill references, and orphaned routes within the routing.json structure.

Running Competitive Security Workflows

With routing configured and tools bootstrapped, execute CTF workflows through the primary entry points.

Execute Master Routing

The master-route.ps1 (Windows) and master-route.sh (Linux) scripts constitute the one-shot entry point that automates the entire workflow: reading routing.json, matching hints to skills, bootstrapping missing tools, and executing the selected CTF sub-skill.

# Windows execution

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/master-route.ps1 -Hint "Sandbox escape challenge"

# Kali Linux execution

bash skills/scripts/master-route.sh -Hint "Binary exploitation CTF"

The -Hint parameter triggers pattern matching against the 41 routing rules, directing execution to the appropriate handler within CTF-Sandbox-Orchestrator/.

Initialize Case Scaffolding

For multi-stage CTF competitions, initialize a dedicated case directory to maintain evidence isolation:

powershell -File skills/scripts/case-init.ps1 -Hint "CTF web challenge series"

This creates work/<case>/scope.md, timeline files, and evidence directories following the Ops & Evidence Layer structure defined in skills/ops/.

Evidence Handling and Reporting

The CTF-Sandbox-Orchestrator captures all artifacts through the Ops & Evidence Layer, generating structured documentation for post-competition analysis.

Evidence Graph Construction

As skills execute, they write findings to work/<case>/evidence/. The system maintains an evidence-finding-path graph that tracks relationships between initial vectors, privilege escalations, and flag captures. This graph is stored in field-journal/ and referenced by the coherence verifier.

Generate Competition Reports

Upon workflow completion, transform evidence into deliverable formats:

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/generate-report.ps1 -CaseId 001

This produces Markdown and PDF reports containing execution timelines, tool outputs, and exploitation chains—essential for CTF write-ups and training documentation.

Regression Testing and Validation

The repository includes a comprehensive regression suite ensuring that CTF workflow modifications maintain system stability.

Run Routing Regression Tests

Before committing changes to routing.json or CTF sub-skills, execute the 163 benchmark cases:

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/test-routing.ps1

This validates that:

• All 41 routing rules resolve to existing skill paths
• Tool discovery correctly identifies platform capabilities
• Bootstrap procedures execute without errors
• Evidence generation produces valid output schemas

Continuous Integration pipelines on Windows and Ubuntu automatically execute these tests, guaranteeing that updates to the CTF-Sandbox-Orchestrator do not break competitive security challenge workflows.

Summary

• The CTF-Sandbox-Orchestrator resides under CTF-Sandbox-Orchestrator/ and provides 40+ specialized sub-skills for competitive security challenges within the zhaoxuya520/reverse-skill repository.
• Routing configuration uses skills/config/routing.json as the single source of truth, containing 41 machine-readable rules that map task hints to specific workflows.
• Tool bootstrapping occurs via bootstrap-manifest.json and platform-specific discovery scripts (ToolDiscovery.ps1 / ToolDiscovery.sh), ensuring idempotent environment preparation.
• Execution entry points are skills/scripts/master-route.ps1 (Windows) and skills/scripts/master-route.sh (Linux), which automate routing, dependency resolution, and workflow initiation.
• Evidence management follows the Ops layer structure in skills/ops/, with automated report generation via generate-report.ps1 and case tracking through case-init.ps1.
• Quality assurance relies on 163 regression test cases in test-routing.ps1 and coherence verification to maintain routing integrity across platform-specific deployments.

Frequently Asked Questions

How does the CTF-Sandbox-Orchestrator handle missing dependencies on a fresh Kali Linux installation?

The orchestrator invokes kali/scripts/ToolDiscovery.sh to scan the environment against skills/tool-index.md. When missing tools are detected, it references bootstrap-manifest.json to execute platform-specific installations using apt, pip, or direct GitHub ZIP extraction, ensuring all 40+ CTF sub-skills have required binaries available before execution begins.

What is the difference between routing.md and routing.json in the CTF workflow setup?

skills/routing.md serves as human-readable documentation describing the routing matrix logic, while skills/config/routing.json provides the machine-readable source of truth containing 41 structured rules that master-route.ps1 parses to determine which CTF sub-skill to execute based on the hint parameter.

Can I add custom CTF challenge types to the existing orchestrator?

Yes. Create a new directory under CTF-Sandbox-Orchestrator/ containing a SKILL.md with front-matter metadata defining trigger patterns and tool requirements. Register the skill in skills/config/routing.json, then run skills/scripts/extract-summaries.ps1 to update the navigation index. Validate changes using verify-routing-coherence.ps1 before running the full regression suite.

How does the system ensure CTF workflow executions remain isolated and auditable?

The skills/scripts/case-init.ps1 script initializes dedicated case directories under work/<case>/ containing isolated scope.md files and timeline tracking. The Ops layer in skills/ops/ maintains evidence-finding-path graphs, while the field-journal/ directory preserves execution history, enabling complete audit trails for competitive security challenge workflows.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}