How to Use CTF-Sandbox-Orchestrator for Multi-Stage Competition Challenges

CTF-Sandbox-Orchestrator is the default entry-point skill in the reverse-skill repository that treats every competition environment as an internal sandbox and automatically routes investigations to domain-specific child skills only when evidence clearly indicates a single attack surface.

The reverse-skill repository provides a structured framework for capture-the-flag (CTF) analysis through the CTF-Sandbox-Orchestrator, which serves as the primary entry point for all competition-related tasks. This orchestrator establishes a reproducible investigation path by modeling the entire environment as a sandbox before delegating to specialized child skills such as $competition-web-runtime or $competition-reverse-pwn. Understanding how to leverage this routing system allows analysts to handle complex multi-stage challenges that span web APIs, native binaries, and cloud containers within a single cohesive workflow.

Architecture and Key Components

Master Workflow Definition

The orchestrator's behavior is defined in CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md, which specifies the default sandbox assumption and routing logic. According to lines 8-11 of this file, every presented host, binary, or identity lives inside the sandbox unless explicit proof indicates otherwise. This master skill is the first selection from skills/MASTER-ROUTING.md when the router detects a competition task.

Routing Decision Matrix

The file CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/references/router-matrix.md contains the decision logic that maps evidence patterns to child skill shortcuts. The matrix defines specific triggers—such as JWT tokens routing to identity skills or container escapes routing to cloud skills—that determine when the orchestrator switches from generic sandbox analysis to domain-specific investigation.

Domain Reference Library

The orchestrator loads reference files on-demand to keep analysis focused. These domain-specific guides include:

• web-api.md for HTTP-based attack surfaces
• reverse-native.md for binary exploitation patterns
• crypto-mobile.md for cryptographic and mobile trust boundaries
• agent-cloud.md for container and CI/CD attack vectors
• identity-windows.md for Active Directory and ticket analysis

Child Skill Ecosystem

Downstream skills such as $competition-web-runtime, $competition-reverse-pwn, and $competition-identity-windows are invoked automatically once the orchestrator identifies a dominant domain. These skills are listed under "Child skill shortcuts" in SKILL.md and are designed to be downstream-only, receiving context from the orchestrator's initial sandbox mapping.

The 5-Step Workflow for Multi-Stage Challenges

The orchestrator follows a strict progression defined in SKILL.md lines 45-116:

1. Sandbox Model Activation: Assume all targets are internal to the sandbox (lines 8-11).
2. Map the Entry Surface: Build a node map tracing host → proxy → container → persistence (lines 45-48).
3. Trace a Minimal Path: Identify the smallest observable unit (single request, file, or crash) that captures the decisive boundary (lines 49-53).
4. Domain Expansion: Load only the relevant reference files (lines 59-65) and route to the matching $competition-* child skill when one domain dominates (lines 66-78).
5. Verification and Reporting: Re-run the path from a clean baseline, collect reproducible evidence, and emit findings (lines 111-116).

Evidence priorities defined in lines 121-128 ensure that live runtime data overrides static artifacts, guaranteeing the most reliable source drives decision-making.

Practical Implementation Examples

Initializing a Competition Case

Create a case directory and scope file using the provided scripts:

# work/ctf-case/scope.md

sandbox: true
targets:
  - url: https://ctf.example.com/api/login
  - binary: bin/challenge_pwn
  - notes: "Redis reachable from container only"

# Initialize and route to orchestrator

powershell -File skills/scripts/case-init.ps1 -CaseName "ctf-case"
powershell -File skills/scripts/master-route.ps1 -Skill ctf-sandbox-orchestrator

The case-init.ps1 script generates the case structure, while master-route.ps1 consults skills/MASTER-ROUTING.md to select the sandbox orchestrator as the entry point.

Capturing Evidence for Routing Decisions

Extract and store evidence to influence the routing matrix:

import requests, json

# Capture JWT from web endpoint

resp = requests.post("https://ctf.example.com/api/login", 
                     json={"user":"alice","pass":"pwd"})
jwt = resp.json()["token"]

# Save for orchestrator analysis

with open("evidence.json", "w") as f:
    json.dump({
        "jwt": jwt, 
        "url": resp.url, 
        "status": resp.status_code
    }, f)

The orchestrator reads evidence.json to determine which child skills to activate based on the router matrix patterns.

Overriding the Router (Advanced)

Force a specific child skill by adding a hint to the scope:

# work/ctf-case/scope.md

preferred_child: competition-web-runtime

This skips sandbox steps and jumps directly to the web-runtime skill, though the source code discourages this unless the analyst is certain of the domain.

Summary

• CTF-Sandbox-Orchestrator in reverse-skill serves as the mandatory entry point for all competition tasks, treating every environment as a sandbox by default according to SKILL.md lines 8-11.
• The orchestrator uses references/router-matrix.md to route investigations to child skills like $competition-web-runtime only after evidence identifies a specific domain.
• The five-step workflow progresses from sandbox activation through minimal path tracing (lines 49-53) to domain-specific child skill invocation (lines 66-78).
• Evidence priorities in SKILL.md lines 121-128 ensure runtime data takes precedence over static artifacts when making routing decisions.
• Analysts initialize cases via skills/scripts/case-init.ps1 and route via skills/scripts/master-route.ps1, storing evidence in JSON format for automated processing.

Frequently Asked Questions

What makes CTF-Sandbox-Orchestrator different from running child skills directly?

The orchestrator enforces a reproducible baseline by modeling the environment as a sandbox before routing, ensuring that multi-stage challenges spanning multiple domains (web, crypto, cloud) are analyzed holistically rather than in isolation. Child skills are downstream-only and lack the context-gathering phase defined in SKILL.md lines 45-53.

How does the orchestrator decide which child skill to invoke?

The decision logic resides in CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/references/router-matrix.md, which maps evidence patterns—such as JWT presence triggering $competition-identity-windows or container behaviors triggering $competition-agent-cloud—to specific shortcuts. The orchestrator evaluates these patterns during the Domain Expansion phase (lines 66-78 of SKILL.md).

Can I use CTF-Sandbox-Orchestrator for single-domain challenges?

Yes. While designed for multi-stage complexity, the orchestrator handles single-domain challenges by completing the minimal path tracing (lines 49-53) and routing to the appropriate single child skill. The sandbox model remains active to ensure reproducibility regardless of challenge complexity.

Where are the evidence priorities defined in the source code?

Evidence priorities are documented in CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md at lines 121-128, which establishes that live runtime data (active network traffic, process memory) overrides static artifacts (saved files, logs) when determining routing decisions.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}