CTF Competition Workflows in reverse-skill via CTF-Sandbox-Orchestrator: A Complete Technical Guide

The CTF-Sandbox-Orchestrator in reverse-skill provides a four-layer sandbox model that initializes isolated investigation environments, traces minimal attack paths, routes to domain-specific child skills via a deterministic router matrix, and enforces unified reporting for consistent CTF competition analysis.

The CTF-Sandbox-Orchestrator serves as the default entry point for all competition-related tasks in the zhaoxuya520/reverse-skill repository. This orchestration system manages CTF competition workflows through a disciplined, reproducible methodology that isolates investigative scope and routes analysis to specialized child skills based on dominant evidence types.

The Four-Layer Sandbox Architecture

The CTF competition workflows operate through four sequential logical layers, each defined in CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md.

Layer 1: Sandbox Model Initialization

The orchestrator assumes all user-presented targets, nodes, and identities belong to the sandbox unless proven otherwise. It constructs a rapid node map following the hierarchy: host → proxy → process/container → persistence → worker.

As documented in SKILL.md lines 43-48, the system applies a "sandbox-first" heuristic: "Treat public-looking domains … as sandbox fixtures first." This prevents premature external attribution and keeps the investigation scope controllable.

Layer 2: Minimal Path Tracing

Starting from a single concrete element—whether a request, file, login, or packet—the orchestrator captures the decisive boundary where behavior changes. This might be an authentication check, parser branch, or exploit primitive.

The methodology mandates changing one variable at a time while validating behavior. Per SKILL.md lines 49-53: "Start from the smallest meaningful unit … Capture the decisive boundary."

Layer 3: Domain-Specific Expansion via Router Matrix

Once the minimal path isolates a dominant evidence type, the orchestrator consults its router matrix to select exactly one matching child skill. This routing system is defined in references/router-matrix.md (lines 19-71).

The router matrix maps dominant surfaces to specialized child skills:

Dominant Surface	Child Skill Token	Reference Location
General web/API behavior	$competition-web-runtime	router-matrix.md §19-22
Binary triage, exploit primitives	$competition-reverse-pwn	router-matrix.md §38-40
Crypto or stego challenges	$competition-crypto-mobile	router-matrix.md §45-48
Identity/Windows host evidence	$competition-identity-windows	router-matrix.md §63-66
ZIP/archive analysis	$competition-zip-archive	Full matrix
Cloud/container/AI agent tasks	$competition-agent-cloud	Full matrix

The orchestrator loads only the reference files matching the selected domain. If a child skill ceases to match the dominant blocker, the system re-routes back to the sandbox layer and re-evaluates (lines 75-80).

Layer 4: Verification and Reporting

The final layer reproduces the critical branch or artifact, distinguishes proof-of-path from proof-of-artifact, and formats results using a concise Chinese-first style as specified in references/reporting.md (lines 5-18).

Domain-Specific Reference Files

Each child skill pulls a dedicated reference markdown that provides checklists, high-value targets, and common pitfalls:

Web/API Runtime Analysis

File: references/web-api.md

Covers high-value targets, evidence checklists, and common pitfalls in web application and API analysis (sections 1-34).

Reverse Engineering and Native Exploitation

File: references/reverse-native.md

Provides passive triage procedures, exploit primitive mapping, and evidence prioritization for binary challenges (sections 5-32).

Cryptography, Steganography, and Mobile

File: references/crypto-mobile.md

Documents transform chain analysis, stego inspection techniques, and mobile manifest analysis workflows (sections 1-41).

Cloud, Containers, and AI Agents

File: references/agent-cloud.md

Addresses prompt injection, CI/CD provenance verification, and container artifact extraction (sections 1-30).

Identity, Windows, and Active Directory

File: references/identity-windows.md

Covers Kerberos/LDAP flow analysis, host forensics, and enterprise messaging abuse patterns (sections 1-38).

Routing and Reporting Examples

The following YAML-style configurations illustrate how downstream skills invoke the orchestrator's routing logic:

# Trigger web-runtime workflow for API-focused CTF tasks

skill: ctf-sandbox-orchestrator
route: $competition-web-runtime

# Force reverse-pwn workflow after binary detection

skill: ctf-sandbox-orchestrator
route: $competition-reverse-pwn

# Structured report output

skill: ctf-sandbox-orchestrator
report:
  verdict: "已成功复现 Web 端点的 SSRF 漏洞"
  evidence:
    - "请求：GET /api/v1/data?url=http://internal.service"
    - "响应：500 Internal Server Error"
    - "利用链：Host Header → SSRF → 内部服务读取 /etc/passwd"
  next: "建议在边界代理层加入白名单校验"

Reporting Schema

The unified reporting format enforces four ordered sections:

1. Verdict / Outcome — Final determination
2. Key Evidence — Paths, offsets, tickets, cryptographic parameters
3. Verification — Replay steps and minimal proof
4. Next Step — Recommended follow-up exploration

This structure eliminates boilerplate while preserving actionable technical detail. Code identifiers remain in their original language regardless of the narrative language.

Summary

• The CTF-Sandbox-Orchestrator is the mandatory entry point for all CTF competition workflows in reverse-skill
• Four layers govern execution: sandbox initialization, minimal path tracing, domain-specific routing, and verification/reporting
• The router matrix (references/router-matrix.md) provides deterministic child skill selection based on dominant evidence type
• Domain reference files supply specialized checklists and pitfalls for web, reverse, crypto, cloud, and identity investigation paths
• Unified reporting (references/reporting.md) enforces consistent Chinese-first output with structured verdict-evidence-verification-next step ordering

Frequently Asked Questions

How does the CTF-Sandbox-Orchestrator decide which child skill to activate?

The orchestrator evaluates the dominant evidence type identified during minimal path tracing, then consults the router matrix in references/router-matrix.md. This deterministic decision tree maps specific evidence surfaces—such as HTTP traffic, ELF binaries, or Kerberos tickets—to exact child skill tokens like $competition-web-runtime or $competition-identity-windows. Only one child skill remains active at any moment.

What happens if the initial child skill doesn't match the evidence?

The orchestrator re-routes back to the sandbox layer and re-evaluates a narrower path. As documented in router-matrix.md lines 75-80, this guarantees a single primary child skill at any moment while preventing investigation drift into mismatched domains.

Why does the reporting format prioritize Chinese language output?

The unified reporting schema in references/reporting.md specifies Chinese-first style to match the primary user community for the reverse-skill project. Technical identifiers—including function names, file paths, and cryptographic parameters—remain in their original language to preserve precision regardless of narrative language.

Where are the core workflow definitions located in the repository?

The orchestrator's complete workflow stack resides under CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/. Key files include SKILL.md (core orchestration), references/router-matrix.md (routing logic), and domain-specific references for web, reverse, crypto, cloud, and identity analysis paths.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}