# CTF Competition Workflows in reverse-skill via CTF-Sandbox-Orchestrator: A Complete Technical Guide

> Explore CTF competition workflows in reverse-skill using CTF-Sandbox-Orchestrator. Learn how to initialize isolated environments, trace attack paths, and unify reporting for expert analysis.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-14

---

**The CTF-Sandbox-Orchestrator in reverse-skill provides a four-layer sandbox model that initializes isolated investigation environments, traces minimal attack paths, routes to domain-specific child skills via a deterministic router matrix, and enforces unified reporting for consistent CTF competition analysis.**

The `CTF-Sandbox-Orchestrator` serves as the default entry point for all competition-related tasks in the [zhaoxuya520/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) repository. This orchestration system manages CTF competition workflows through a disciplined, reproducible methodology that isolates investigative scope and routes analysis to specialized child skills based on dominant evidence types.

## The Four-Layer Sandbox Architecture

The CTF competition workflows operate through four sequential logical layers, each defined in [`CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md).

### Layer 1: Sandbox Model Initialization

The orchestrator assumes all user-presented targets, nodes, and identities belong to the sandbox unless proven otherwise. It constructs a rapid node map following the hierarchy: **host → proxy → process/container → persistence → worker**.

As documented in [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) lines 43-48, the system applies a "sandbox-first" heuristic: *"Treat public-looking domains … as sandbox fixtures first."* This prevents premature external attribution and keeps the investigation scope controllable.

### Layer 2: Minimal Path Tracing

Starting from a single concrete element—whether a request, file, login, or packet—the orchestrator captures the **decisive boundary** where behavior changes. This might be an authentication check, parser branch, or exploit primitive.

The methodology mandates changing one variable at a time while validating behavior. Per [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) lines 49-53: *"Start from the smallest meaningful unit … Capture the decisive boundary."*

### Layer 3: Domain-Specific Expansion via Router Matrix

Once the minimal path isolates a **dominant evidence type**, the orchestrator consults its router matrix to select exactly one matching child skill. This routing system is defined in [`references/router-matrix.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/router-matrix.md) (lines 19-71).

The router matrix maps dominant surfaces to specialized child skills:

| Dominant Surface | Child Skill Token | Reference Location |
|------------------|-------------------|------------------|
| General web/API behavior | `$competition-web-runtime` | [`router-matrix.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/router-matrix.md) §19-22 |
| Binary triage, exploit primitives | `$competition-reverse-pwn` | [`router-matrix.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/router-matrix.md) §38-40 |
| Crypto or stego challenges | `$competition-crypto-mobile` | [`router-matrix.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/router-matrix.md) §45-48 |
| Identity/Windows host evidence | `$competition-identity-windows` | [`router-matrix.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/router-matrix.md) §63-66 |
| ZIP/archive analysis | `$competition-zip-archive` | Full matrix |
| Cloud/container/AI agent tasks | `$competition-agent-cloud` | Full matrix |

The orchestrator loads **only** the reference files matching the selected domain. If a child skill ceases to match the dominant blocker, the system re-routes back to the sandbox layer and re-evaluates (lines 75-80).

### Layer 4: Verification and Reporting

The final layer reproduces the critical branch or artifact, distinguishes **proof-of-path** from **proof-of-artifact**, and formats results using a concise **Chinese-first style** as specified in [`references/reporting.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/reporting.md) (lines 5-18).

## Domain-Specific Reference Files

Each child skill pulls a dedicated reference markdown that provides checklists, high-value targets, and common pitfalls:

### Web/API Runtime Analysis

**File:** [`references/web-api.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/web-api.md)

Covers high-value targets, evidence checklists, and common pitfalls in web application and API analysis (sections 1-34).

### Reverse Engineering and Native Exploitation

**File:** [`references/reverse-native.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/reverse-native.md)

Provides passive triage procedures, exploit primitive mapping, and evidence prioritization for binary challenges (sections 5-32).

### Cryptography, Steganography, and Mobile

**File:** [`references/crypto-mobile.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/crypto-mobile.md)

Documents transform chain analysis, stego inspection techniques, and mobile manifest analysis workflows (sections 1-41).

### Cloud, Containers, and AI Agents

**File:** [`references/agent-cloud.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/agent-cloud.md)

Addresses prompt injection, CI/CD provenance verification, and container artifact extraction (sections 1-30).

### Identity, Windows, and Active Directory

**File:** [`references/identity-windows.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/identity-windows.md)

Covers Kerberos/LDAP flow analysis, host forensics, and enterprise messaging abuse patterns (sections 1-38).

## Routing and Reporting Examples

The following YAML-style configurations illustrate how downstream skills invoke the orchestrator's routing logic:

```yaml

# Trigger web-runtime workflow for API-focused CTF tasks

skill: ctf-sandbox-orchestrator
route: $competition-web-runtime

```

```yaml

# Force reverse-pwn workflow after binary detection

skill: ctf-sandbox-orchestrator
route: $competition-reverse-pwn

```

```yaml

# Structured report output

skill: ctf-sandbox-orchestrator
report:
  verdict: "已成功复现 Web 端点的 SSRF 漏洞"
  evidence:
    - "请求：GET /api/v1/data?url=http://internal.service"
    - "响应：500 Internal Server Error"
    - "利用链：Host Header → SSRF → 内部服务读取 /etc/passwd"
  next: "建议在边界代理层加入白名单校验"

```

## Reporting Schema

The unified reporting format enforces four ordered sections:

1. **Verdict / Outcome** — Final determination
2. **Key Evidence** — Paths, offsets, tickets, cryptographic parameters
3. **Verification** — Replay steps and minimal proof
4. **Next Step** — Recommended follow-up exploration

This structure eliminates boilerplate while preserving actionable technical detail. Code identifiers remain in their original language regardless of the narrative language.

## Summary

- The **CTF-Sandbox-Orchestrator** is the mandatory entry point for all CTF competition workflows in reverse-skill
- **Four layers** govern execution: sandbox initialization, minimal path tracing, domain-specific routing, and verification/reporting
- The **router matrix** ([`references/router-matrix.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/router-matrix.md)) provides deterministic child skill selection based on dominant evidence type
- **Domain reference files** supply specialized checklists and pitfalls for web, reverse, crypto, cloud, and identity investigation paths
- **Unified reporting** ([`references/reporting.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/reporting.md)) enforces consistent Chinese-first output with structured verdict-evidence-verification-next step ordering

## Frequently Asked Questions

### How does the CTF-Sandbox-Orchestrator decide which child skill to activate?

The orchestrator evaluates the **dominant evidence type** identified during minimal path tracing, then consults the router matrix in [`references/router-matrix.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/router-matrix.md). This deterministic decision tree maps specific evidence surfaces—such as HTTP traffic, ELF binaries, or Kerberos tickets—to exact child skill tokens like `$competition-web-runtime` or `$competition-identity-windows`. Only one child skill remains active at any moment.

### What happens if the initial child skill doesn't match the evidence?

The orchestrator **re-routes** back to the sandbox layer and re-evaluates a narrower path. As documented in [`router-matrix.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/router-matrix.md) lines 75-80, this guarantees a single primary child skill at any moment while preventing investigation drift into mismatched domains.

### Why does the reporting format prioritize Chinese language output?

The unified reporting schema in [`references/reporting.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/reporting.md) specifies **Chinese-first style** to match the primary user community for the reverse-skill project. Technical identifiers—including function names, file paths, and cryptographic parameters—remain in their original language to preserve precision regardless of narrative language.

### Where are the core workflow definitions located in the repository?

The orchestrator's complete workflow stack resides under `CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/`. Key files include [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) (core orchestration), [`references/router-matrix.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/router-matrix.md) (routing logic), and domain-specific references for web, reverse, crypto, cloud, and identity analysis paths.