# How to Use CTF-Sandbox-Orchestrator for Multi-Stage Competition Challenges

> Master multi-stage CTF challenges with CTF-Sandbox-Orchestrator. Learn how this tool streamlines investigations by routing evidence to specific skills for efficient analysis. Unlock advanced competition strategies.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-07

---

**CTF-Sandbox-Orchestrator** is the default entry-point skill in the `reverse-skill` repository that treats every competition environment as an internal sandbox and automatically routes investigations to domain-specific child skills only when evidence clearly indicates a single attack surface.

The `reverse-skill` repository provides a structured framework for capture-the-flag (CTF) analysis through the **CTF-Sandbox-Orchestrator**, which serves as the primary entry point for all competition-related tasks. This orchestrator establishes a reproducible investigation path by modeling the entire environment as a sandbox before delegating to specialized child skills such as `$competition-web-runtime` or `$competition-reverse-pwn`. Understanding how to leverage this routing system allows analysts to handle complex multi-stage challenges that span web APIs, native binaries, and cloud containers within a single cohesive workflow.

## Architecture and Key Components

### Master Workflow Definition

The orchestrator's behavior is defined in [`CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md), which specifies the default sandbox assumption and routing logic. According to lines 8-11 of this file, every presented host, binary, or identity lives inside the sandbox unless explicit proof indicates otherwise. This master skill is the first selection from [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) when the router detects a competition task.

### Routing Decision Matrix

The file [`CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/references/router-matrix.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/references/router-matrix.md) contains the decision logic that maps evidence patterns to child skill shortcuts. The matrix defines specific triggers—such as JWT tokens routing to identity skills or container escapes routing to cloud skills—that determine when the orchestrator switches from generic sandbox analysis to domain-specific investigation.

### Domain Reference Library

The orchestrator loads reference files on-demand to keep analysis focused. These domain-specific guides include:

- [`web-api.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/web-api.md) for HTTP-based attack surfaces
- [`reverse-native.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/reverse-native.md) for binary exploitation patterns
- [`crypto-mobile.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/crypto-mobile.md) for cryptographic and mobile trust boundaries
- [`agent-cloud.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/agent-cloud.md) for container and CI/CD attack vectors
- [`identity-windows.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/identity-windows.md) for Active Directory and ticket analysis

### Child Skill Ecosystem

Downstream skills such as `$competition-web-runtime`, `$competition-reverse-pwn`, and `$competition-identity-windows` are invoked automatically once the orchestrator identifies a dominant domain. These skills are listed under "Child skill shortcuts" in [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) and are designed to be downstream-only, receiving context from the orchestrator's initial sandbox mapping.

## The 5-Step Workflow for Multi-Stage Challenges

The orchestrator follows a strict progression defined in [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) lines 45-116:

1. **Sandbox Model Activation**: Assume all targets are internal to the sandbox (lines 8-11).
2. **Map the Entry Surface**: Build a node map tracing host → proxy → container → persistence (lines 45-48).
3. **Trace a Minimal Path**: Identify the smallest observable unit (single request, file, or crash) that captures the decisive boundary (lines 49-53).
4. **Domain Expansion**: Load only the relevant reference files (lines 59-65) and route to the matching `$competition-*` child skill when one domain dominates (lines 66-78).
5. **Verification and Reporting**: Re-run the path from a clean baseline, collect reproducible evidence, and emit findings (lines 111-116).

Evidence priorities defined in lines 121-128 ensure that live runtime data overrides static artifacts, guaranteeing the most reliable source drives decision-making.

## Practical Implementation Examples

### Initializing a Competition Case

Create a case directory and scope file using the provided scripts:

```yaml

# work/ctf-case/scope.md

sandbox: true
targets:
  - url: https://ctf.example.com/api/login
  - binary: bin/challenge_pwn
  - notes: "Redis reachable from container only"

```

```powershell

# Initialize and route to orchestrator

powershell -File skills/scripts/case-init.ps1 -CaseName "ctf-case"
powershell -File skills/scripts/master-route.ps1 -Skill ctf-sandbox-orchestrator

```

The `case-init.ps1` script generates the case structure, while `master-route.ps1` consults [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) to select the sandbox orchestrator as the entry point.

### Capturing Evidence for Routing Decisions

Extract and store evidence to influence the routing matrix:

```python
import requests, json

# Capture JWT from web endpoint

resp = requests.post("https://ctf.example.com/api/login", 
                     json={"user":"alice","pass":"pwd"})
jwt = resp.json()["token"]

# Save for orchestrator analysis

with open("evidence.json", "w") as f:
    json.dump({
        "jwt": jwt, 
        "url": resp.url, 
        "status": resp.status_code
    }, f)

```

The orchestrator reads [`evidence.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/evidence.json) to determine which child skills to activate based on the router matrix patterns.

### Overriding the Router (Advanced)

Force a specific child skill by adding a hint to the scope:

```yaml

# work/ctf-case/scope.md

preferred_child: competition-web-runtime

```

This skips sandbox steps and jumps directly to the web-runtime skill, though the source code discourages this unless the analyst is certain of the domain.

## Summary

- **CTF-Sandbox-Orchestrator** in `reverse-skill` serves as the mandatory entry point for all competition tasks, treating every environment as a sandbox by default according to [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) lines 8-11.
- The orchestrator uses [`references/router-matrix.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/router-matrix.md) to route investigations to child skills like `$competition-web-runtime` only after evidence identifies a specific domain.
- The five-step workflow progresses from sandbox activation through minimal path tracing (lines 49-53) to domain-specific child skill invocation (lines 66-78).
- Evidence priorities in [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) lines 121-128 ensure runtime data takes precedence over static artifacts when making routing decisions.
- Analysts initialize cases via `skills/scripts/case-init.ps1` and route via `skills/scripts/master-route.ps1`, storing evidence in JSON format for automated processing.

## Frequently Asked Questions

### What makes CTF-Sandbox-Orchestrator different from running child skills directly?

The orchestrator enforces a reproducible baseline by modeling the environment as a sandbox before routing, ensuring that multi-stage challenges spanning multiple domains (web, crypto, cloud) are analyzed holistically rather than in isolation. Child skills are downstream-only and lack the context-gathering phase defined in [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) lines 45-53.

### How does the orchestrator decide which child skill to invoke?

The decision logic resides in [`CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/references/router-matrix.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/references/router-matrix.md), which maps evidence patterns—such as JWT presence triggering `$competition-identity-windows` or container behaviors triggering `$competition-agent-cloud`—to specific shortcuts. The orchestrator evaluates these patterns during the Domain Expansion phase (lines 66-78 of [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md)).

### Can I use CTF-Sandbox-Orchestrator for single-domain challenges?

Yes. While designed for multi-stage complexity, the orchestrator handles single-domain challenges by completing the minimal path tracing (lines 49-53) and routing to the appropriate single child skill. The sandbox model remains active to ensure reproducibility regardless of challenge complexity.

### Where are the evidence priorities defined in the source code?

Evidence priorities are documented in [`CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md) at lines 121-128, which establishes that live runtime data (active network traffic, process memory) overrides static artifacts (saved files, logs) when determining routing decisions.