What Is the CTF-Sandbox-Orchestrator and How Does It Work?

The CTF-Sandbox-Orchestrator is the master entry-point skill in the zhaoxuya520/reverse-skill repository that automates competition-style security challenges by assuming all targets exist within an isolated sandbox and routing analysis tasks to specialized child skills based on evidence-driven workflow stages.

The CTF-Sandbox-Orchestrator serves as the central coordination layer for capture-the-flag (CTF) and professional security competitions. Unlike standalone analysis tools, this system treats every binary, API endpoint, or identity presented by users as untrusted data within a contained environment, eliminating the need for manual skill selection while maintaining a reproducible evidence chain.

Core Architecture and Design Philosophy

Master Skill Definition

The orchestrator's behavior is defined in CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md, which provides YAML front-matter containing the human-readable skill name and description. This file establishes the router role—acting as the sole default entry point for the entire competition skill family. Rather than exposing dozens of specialized skills to users, the orchestrator internally selects narrower child skills only after identifying concrete evidence types or minimal execution paths.

Evidence-Driven Prioritization

The system ranks investigation targets using a strict hierarchy to ensure volatile data is captured first:

• Live runtime behavior
• Captured traffic
• Served assets
• Process configuration
• Persisted state
• Generated artifacts
• Source code
• Comments

This prioritization ensures that transient sandbox data is preserved before examining static resources.

How the CTF-Sandbox-Orchestrator Works

The orchestrator executes a four-stage workflow that progresses from environmental modeling to final reporting, as implemented in the master SKILL.md.

Stage 1: Establish the Sandbox Model

The system builds a comprehensive node map representing the attack surface: host → proxy → process/container → persistence layer. This model operates under core rules that mandate treating all challenge artifacts as untrusted data, avoiding unnecessary "real-vs-fake" verification checks, keeping all changes reversible, and never exposing user secrets.

Stage 2: Trace One Minimal Path

Analysts isolate a single request, file, or packet that demonstrates a decisive boundary—whether authentication validation, parser behavior, cryptographic operations, or privilege escalation. This minimal path serves as the routing key for selecting specialized analysis procedures.

Stage 3: Expand By Challenge Type

Based on the minimal path evidence, the orchestrator loads exactly one domain-specific reference file from the references/ directory:

• web-api.md for HTTP/API challenges
• reverse-native.md for binary exploitation
• crypto-mobile.md for cryptography and mobile tasks
• agent-cloud.md for cloud and container forensics
• identity-windows.md for Active Directory scenarios

The routing logic is encoded in references/router-matrix.md, which maps evidence patterns to child skills such as $competition-web-runtime, $competition-reverse-pwn, or $competition-crypto-mobile.

Stage 4: Verify And Report

The system reproduces the identified path from a clean baseline, separates proof-of-path from proof-of-artifact, and generates concise findings using the template defined in references/reporting.md. This ensures results are deterministic and reproducible across sandbox resets.

Internal Routing and Child Skill Delegation

The orchestrator eliminates manual skill selection by implementing an internal routing matrix. After Stage 2 identifies a minimal evidence path, the system automatically invokes the appropriate child skill:

# Internal routing example after web-runtime identification

$child = '$competition-web-runtime'
. (Join-Path $OrchestratorRoot $child 'SKILL.ps1')

This delegation occurs within the same orchestrator instance, maintaining state continuity while executing domain-specific playbooks contained in child skill files.

Practical Implementation Examples

Invoking from PowerShell

The primary router script skills/scripts/master-route.ps1 handles initial task ingestion and hands off to the orchestrator:

# Provide a challenge hint containing a web URL

.\skills\scripts\master-route.ps1 -Hint "http://challenge.example.com/login"

This script parses the hint, scores keywords against the routing matrix, and initiates the workflow defined in SKILL.md.

Recording Evidence

During analysis, the orchestrator captures structured evidence following the priority hierarchy using internal helpers from skills/scripts/lib/ (such as WorkRoot.ps1):

# Evidence capture example

$evidence = @{
    Request   = "GET /api/v1/secret HTTP/1.1"
    Response  = "200 OK"
    Headers   = @{ Authorization = "Bearer abc123" }
    Hash      = "sha256:5d41402abc4b2a76b9719d911017c592"
}
Export-Evidence -Path "$OutDir/evidence.json" -Data $evidence

The implementation consumes scope contracts and evidence chain definitions from skills/ops/ to maintain forensic integrity.

Summary

• The CTF-Sandbox-Orchestrator acts as the master entry point for all competition-style analysis tasks in the reverse-skill repository.
• It assumes all targets reside within isolated sandbox environments, treating every artifact as untrusted data while avoiding unnecessary verification steps.
• The workflow follows four stages: establishing the sandbox model, tracing a minimal path, expanding by challenge type using reference files, and verifying results against a clean baseline.
• Domain-specific logic resides in child skills (e.g., $competition-web-runtime) selected automatically via the routing matrix in references/router-matrix.md.
• Evidence collection follows a strict priority hierarchy from volatile runtime behavior down to static source code, ensuring critical transient data is preserved first.

Frequently Asked Questions

What file contains the main orchestration logic for the CTF-Sandbox-Orchestrator?

The primary definition resides in CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md, which contains the YAML front-matter, workflow stages, core rules, and evidence priorities. This file coordinates the entire analysis pipeline from initial hint ingestion through final reporting using the template in references/reporting.md.

How does the orchestrator decide which specialized skill to use for a given challenge?

The system maps minimal evidence paths to child skills using the routing matrix defined in references/router-matrix.md. After Stage 2 identifies a decisive boundary—such as an HTTP request for web challenges or a binary crash for pwn tasks—the orchestrator automatically loads the appropriate reference file from the references/ directory and invokes the corresponding child skill without requiring manual user selection.

What types of security challenges does the CTF-Sandbox-Orchestrator support?

According to the reverse-skill source code, the orchestrator handles CTF competitions, exploit development, reverse engineering, DFIR (Digital Forensics and Incident Response), cryptography, mobile analysis, cloud security, container forensics, and Active Directory identity challenges. Each domain maintains a dedicated reference file that the orchestrator loads on-demand to avoid bulk-loading unnecessary documentation.

Why does the orchestrator prioritize live runtime behavior over source code analysis?

The evidence prioritization scheme ranks live runtime behavior highest because volatile data—including running processes, active network connections, and in-memory artifacts—disappears when the sandbox environment resets. Static sources like code and comments remain available for later analysis, making runtime evidence the most time-sensitive and valuable for competition scenarios where reproducibility and speed are critical.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}