# CTF-Sandbox-Orchestrator Capabilities: A Complete Guide to Unified Competition Analysis

> Explore CTF-Sandbox-Orchestrator capabilities for unified competition analysis. Dynamically route challenges and enforce a sandbox-first workflow for evidence-driven security.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-23

---

**The CTF-Sandbox-Orchestrator serves as the unified entrypoint for all competition-style security challenges, dynamically routing analysis to specialized child skills while enforcing a sandbox-first, evidence-driven workflow.**

The `CTF-Sandbox-Orchestrator` is the default entrypoint for competition tasks including CTF, exploit development, reverse-engineering, DFIR, cryptography, steganography, mobile, and cloud challenges within the `zhaoxuya520/reverse-skill` repository. It establishes a disciplined, reproducible investigation model that routes analysis to the most specific child skill based on dominant evidence types. This orchestrator eliminates wasted effort by assuming all targets belong to the sandbox until proven otherwise, keeping investigations focused and evidence-driven.

## Core Architecture Components

The orchestrator's architecture rests on two foundational concepts that distinguish it from general-purpose analysis frameworks: the **Sandbox Model** and the **Router Role**.

### Sandbox Model Assumptions

According to [`CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md), the orchestrator assumes every presented target—whether hosts, binaries, identities, or URLs—belongs to the sandbox until proven otherwise. This assumption builds a minimal node map tracing the attack surface from **host → proxy → process/container → persistence → downstream worker**. By maintaining this map, investigators avoid wasting cycles on "real-world" checks when operating within controlled competition environments.

### Router Role and Dynamic Routing

The orchestrator acts as the sole default entrypoint for any challenge. After identifying a minimal path, it selects the narrowest matching child skill from the `$competition-*` namespace that corresponds to the dominant evidence type. This routing logic is defined in [`references/router-matrix.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/router-matrix.md), which maps over 30 specialized skills across domains including web/runtime, reverse/pwn, crypto/mobile, agent/cloud, and identity/Windows.

## The Four-Phase Investigation Workflow

The [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) file defines a strict four-phase workflow that ensures reproducible results across all challenge types:

1. **Establish the sandbox model** – Map all surfaces and mark unknown nodes explicitly, creating a boundary of what belongs to the controlled environment versus external systems.

2. **Trace one minimal path** – Isolate a single request, file, crash, or artifact and capture its decisive boundary. This prevents scope creep by focusing on one concrete flow before expansion.

3. **Expand by challenge type** – Load only the reference file(s) corresponding to the identified domain (web, crypto, reverse, etc.) to apply domain-specific ladders and checklists.

4. **Verify & Report** – Reproduce the flow, collect compact evidence, and output findings according to the minimal reporting format defined in [`references/reporting.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/reporting.md).

## Evidence Prioritization Strategy

The orchestrator enforces an **evidence-first methodology** that prioritizes live behavior over static artifacts. The [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) document establishes the following reliability ranking, from most to least trustworthy:

- **Live runtime behavior** – Active process execution and real-time interactions
- **Captured traffic** – Network intercepts and protocol analysis
- **Actively served assets** – Currently hosted files and APIs
- **Process/container config** – Runtime configurations and environment variables
- **Persisted challenge state** – Saved game states or checkpoint files
- **Generated artifacts** – Build outputs and compilation results
- **Checked-in source** – Version-controlled code repositories
- **Comments & screenshots** – Human annotations and visual documentation

This hierarchy ensures investigators rely on observable behavior rather than potentially misleading documentation or static analysis alone.

## Routing Matrix and Child Skills

The orchestrator's power lies in its dynamic routing capability. The [`references/router-matrix.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/router-matrix.md) file contains a decision matrix that determines when to remain in the orchestrator versus handing off to specialized child skills. The matrix covers more than 30 `$competition-*` skills organized by technical domain.

### Domain-Specific Reference Guides

Each domain includes a concise reference file containing best-practice ladders, high-value targets, evidence checklists, and common pitfalls:

- **Web/API/Runtime** – Consult [`references/web-api.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/web-api.md) for HTTP request analysis, API endpoint enumeration, and runtime exploitation techniques.
- **Reverse/Native** – Use [`references/reverse-native.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/reverse-native.md) for binary analysis, debugger configuration, and native code decompilation strategies.
- **Crypto/Mobile** – Reference [`references/crypto-mobile.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/crypto-mobile.md) for cryptographic challenge solving, steganography detection, and mobile application testing.
- **Agent/Cloud** – Check [`references/agent-cloud.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/agent-cloud.md) for container orchestration analysis, supply-chain security, and cloud-native exploitation.
- **Identity/Windows** – Review [`references/identity-windows.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/identity-windows.md) for Active Directory analysis, Windows host forensics, and identity chain verification.

## Reporting and Reproducibility Standards

The [`references/reporting.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/reporting.md) file defines the minimal set of reproducible artifacts required for valid submissions. A proper report must include concrete paths, specific requests with full headers, cryptographic hashes of relevant files, ticket numbers, and environment snapshots. This standardization ensures that competition organizers can verify solutions independently and that findings remain valid across different analysis environments.

## Practical Usage Examples

Invoke the orchestrator through the master routing script when beginning any competition challenge:

```bash

# Invoke the orchestrator with a domain hint

bash skills/scripts/master-route.sh --hint "web challenge with hidden API"

```

The orchestrator automatically handles child skill selection based on identified blockers. For example, when the orchestrator detects a web-runtime blocker, it routes control to `$competition-web-runtime` without manual intervention.

Capture evidence according to the orchestrator's prioritization schema:

```json
{
  "request": {
    "method": "GET",
    "url": "https://sandbox.example/api/secret",
    "headers": {"Cookie": "session=abcd"},
    "body": ""
  },
  "response": {
    "status": 200,
    "body": "{\"flag\":\"CTF{example}\"}"
  },
  "hashes": {"response_body_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},
  "notes": "Minimal path: single GET request yields flag; verified via live capture"
}

```

When the dominant blocker changes during analysis, the orchestrator includes **re-routing logic** that automatically returns control to the parent orchestrator for redistribution to a more appropriate child skill.

## Summary

- The **CTF-Sandbox-Orchestrator** provides a unified entrypoint for all competition-style security challenges in the `zhaoxuya520/reverse-skill` repository.
- It assumes a **sandbox-first model** that treats all targets as belonging to the controlled environment until proven otherwise.
- Dynamic routing via [`references/router-matrix.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/router-matrix.md) connects investigators to over 30 specialized `$competition-*` child skills.
- The four-phase workflow (**Establish, Trace, Expand, Verify**) ensures reproducible, evidence-driven investigations.
- **Evidence prioritization** ranks live runtime behavior highest and human comments lowest, promoting objective analysis.
- Domain-specific reference files in the `references/` directory provide targeted guidance for web, reverse engineering, crypto, cloud, and identity challenges.
- Minimal reporting standards defined in [`references/reporting.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/reporting.md) guarantee reproducible findings with concrete artifacts and hashes.

## Frequently Asked Questions

### What makes the CTF-Sandbox-Orchestrator different from other analysis frameworks?

Unlike general-purpose security frameworks, the CTF-Sandbox-Orchestrator assumes all targets belong to a sandboxed competition environment rather than production systems. This assumption, documented in [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md), eliminates wasted time on "real-world" impact assessments and focuses entirely on the challenge boundary. Additionally, its dynamic routing system automatically delegates to specialized child skills based on evidence type, rather than requiring manual tool selection.

### How does the orchestrator handle multiple competing evidence types?

The orchestrator applies a strict **evidence priority ranking** defined in [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md). When conflicting indicators appear, live runtime behavior overrides static artifacts, and captured network traffic overrides configuration files. This hierarchy ensures investigators follow the most reliable data source available. If the dominant evidence type changes during analysis, the orchestrator's re-routing logic returns control to the parent to select a more appropriate `$competition-*` skill.

### Can the orchestrator be used outside of CTF competitions?

While designed for competition environments, the orchestrator's **sandbox model** methodology applies to any controlled testing scenario where targets are isolated from production systems. The [`references/router-matrix.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/router-matrix.md) supports diverse technical domains including cloud infrastructure, mobile applications, and Windows Active Directory environments. However, the evidence prioritization schema assumes laboratory conditions where live exploitation is permitted and expected.

### What files should I consult for web application challenges?

For web, API, and runtime analysis challenges, reference [`CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/references/web-api.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/references/web-api.md). This file contains the domain-specific ladder for HTTP request analysis, endpoint enumeration techniques, and common pitfalls in web-based CTF challenges. The orchestrator automatically routes web-dominant evidence to the `$competition-web-runtime` child skill, which implements the methodologies described in this reference document.