CTF-Sandbox-Orchestrator Capabilities: A Complete Guide to Unified Competition Analysis

The CTF-Sandbox-Orchestrator serves as the unified entrypoint for all competition-style security challenges, dynamically routing analysis to specialized child skills while enforcing a sandbox-first, evidence-driven workflow.

The CTF-Sandbox-Orchestrator is the default entrypoint for competition tasks including CTF, exploit development, reverse-engineering, DFIR, cryptography, steganography, mobile, and cloud challenges within the zhaoxuya520/reverse-skill repository. It establishes a disciplined, reproducible investigation model that routes analysis to the most specific child skill based on dominant evidence types. This orchestrator eliminates wasted effort by assuming all targets belong to the sandbox until proven otherwise, keeping investigations focused and evidence-driven.

Core Architecture Components

The orchestrator's architecture rests on two foundational concepts that distinguish it from general-purpose analysis frameworks: the Sandbox Model and the Router Role.

Sandbox Model Assumptions

According to CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md, the orchestrator assumes every presented target—whether hosts, binaries, identities, or URLs—belongs to the sandbox until proven otherwise. This assumption builds a minimal node map tracing the attack surface from host → proxy → process/container → persistence → downstream worker. By maintaining this map, investigators avoid wasting cycles on "real-world" checks when operating within controlled competition environments.

Router Role and Dynamic Routing

The orchestrator acts as the sole default entrypoint for any challenge. After identifying a minimal path, it selects the narrowest matching child skill from the $competition-* namespace that corresponds to the dominant evidence type. This routing logic is defined in references/router-matrix.md, which maps over 30 specialized skills across domains including web/runtime, reverse/pwn, crypto/mobile, agent/cloud, and identity/Windows.

The Four-Phase Investigation Workflow

The SKILL.md file defines a strict four-phase workflow that ensures reproducible results across all challenge types:

1. Establish the sandbox model – Map all surfaces and mark unknown nodes explicitly, creating a boundary of what belongs to the controlled environment versus external systems.

2. Trace one minimal path – Isolate a single request, file, crash, or artifact and capture its decisive boundary. This prevents scope creep by focusing on one concrete flow before expansion.

3. Expand by challenge type – Load only the reference file(s) corresponding to the identified domain (web, crypto, reverse, etc.) to apply domain-specific ladders and checklists.

4. Verify & Report – Reproduce the flow, collect compact evidence, and output findings according to the minimal reporting format defined in references/reporting.md.

Evidence Prioritization Strategy

The orchestrator enforces an evidence-first methodology that prioritizes live behavior over static artifacts. The SKILL.md document establishes the following reliability ranking, from most to least trustworthy:

• Live runtime behavior – Active process execution and real-time interactions
• Captured traffic – Network intercepts and protocol analysis
• Actively served assets – Currently hosted files and APIs
• Process/container config – Runtime configurations and environment variables
• Persisted challenge state – Saved game states or checkpoint files
• Generated artifacts – Build outputs and compilation results
• Checked-in source – Version-controlled code repositories
• Comments & screenshots – Human annotations and visual documentation

This hierarchy ensures investigators rely on observable behavior rather than potentially misleading documentation or static analysis alone.

Routing Matrix and Child Skills

The orchestrator's power lies in its dynamic routing capability. The references/router-matrix.md file contains a decision matrix that determines when to remain in the orchestrator versus handing off to specialized child skills. The matrix covers more than 30 $competition-* skills organized by technical domain.

Domain-Specific Reference Guides

Each domain includes a concise reference file containing best-practice ladders, high-value targets, evidence checklists, and common pitfalls:

• Web/API/Runtime – Consult references/web-api.md for HTTP request analysis, API endpoint enumeration, and runtime exploitation techniques.
• Reverse/Native – Use references/reverse-native.md for binary analysis, debugger configuration, and native code decompilation strategies.
• Crypto/Mobile – Reference references/crypto-mobile.md for cryptographic challenge solving, steganography detection, and mobile application testing.
• Agent/Cloud – Check references/agent-cloud.md for container orchestration analysis, supply-chain security, and cloud-native exploitation.
• Identity/Windows – Review references/identity-windows.md for Active Directory analysis, Windows host forensics, and identity chain verification.

Reporting and Reproducibility Standards

The references/reporting.md file defines the minimal set of reproducible artifacts required for valid submissions. A proper report must include concrete paths, specific requests with full headers, cryptographic hashes of relevant files, ticket numbers, and environment snapshots. This standardization ensures that competition organizers can verify solutions independently and that findings remain valid across different analysis environments.

Practical Usage Examples

Invoke the orchestrator through the master routing script when beginning any competition challenge:

# Invoke the orchestrator with a domain hint

bash skills/scripts/master-route.sh --hint "web challenge with hidden API"

The orchestrator automatically handles child skill selection based on identified blockers. For example, when the orchestrator detects a web-runtime blocker, it routes control to $competition-web-runtime without manual intervention.

Capture evidence according to the orchestrator's prioritization schema:

{
  "request": {
    "method": "GET",
    "url": "https://sandbox.example/api/secret",
    "headers": {"Cookie": "session=abcd"},
    "body": ""
  },
  "response": {
    "status": 200,
    "body": "{\"flag\":\"CTF{example}\"}"
  },
  "hashes": {"response_body_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},
  "notes": "Minimal path: single GET request yields flag; verified via live capture"
}

When the dominant blocker changes during analysis, the orchestrator includes re-routing logic that automatically returns control to the parent orchestrator for redistribution to a more appropriate child skill.

Summary

• The CTF-Sandbox-Orchestrator provides a unified entrypoint for all competition-style security challenges in the zhaoxuya520/reverse-skill repository.
• It assumes a sandbox-first model that treats all targets as belonging to the controlled environment until proven otherwise.
• Dynamic routing via references/router-matrix.md connects investigators to over 30 specialized $competition-* child skills.
• The four-phase workflow (Establish, Trace, Expand, Verify) ensures reproducible, evidence-driven investigations.
• Evidence prioritization ranks live runtime behavior highest and human comments lowest, promoting objective analysis.
• Domain-specific reference files in the references/ directory provide targeted guidance for web, reverse engineering, crypto, cloud, and identity challenges.
• Minimal reporting standards defined in references/reporting.md guarantee reproducible findings with concrete artifacts and hashes.

Frequently Asked Questions

What makes the CTF-Sandbox-Orchestrator different from other analysis frameworks?

Unlike general-purpose security frameworks, the CTF-Sandbox-Orchestrator assumes all targets belong to a sandboxed competition environment rather than production systems. This assumption, documented in SKILL.md, eliminates wasted time on "real-world" impact assessments and focuses entirely on the challenge boundary. Additionally, its dynamic routing system automatically delegates to specialized child skills based on evidence type, rather than requiring manual tool selection.

How does the orchestrator handle multiple competing evidence types?

The orchestrator applies a strict evidence priority ranking defined in SKILL.md. When conflicting indicators appear, live runtime behavior overrides static artifacts, and captured network traffic overrides configuration files. This hierarchy ensures investigators follow the most reliable data source available. If the dominant evidence type changes during analysis, the orchestrator's re-routing logic returns control to the parent to select a more appropriate $competition-* skill.

Can the orchestrator be used outside of CTF competitions?

While designed for competition environments, the orchestrator's sandbox model methodology applies to any controlled testing scenario where targets are isolated from production systems. The references/router-matrix.md supports diverse technical domains including cloud infrastructure, mobile applications, and Windows Active Directory environments. However, the evidence prioritization schema assumes laboratory conditions where live exploitation is permitted and expected.

What files should I consult for web application challenges?

For web, API, and runtime analysis challenges, reference CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/references/web-api.md. This file contains the domain-specific ladder for HTTP request analysis, endpoint enumeration techniques, and common pitfalls in web-based CTF challenges. The orchestrator automatically routes web-dominant evidence to the $competition-web-runtime child skill, which implements the methodologies described in this reference document.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}