ctf-skills

What It Does

ctf-skills is an Agent Skills pack (compatible with Claude Code, Codex, Gemini, opencode, and anything else supporting the agentskills.io spec) for solving Capture The Flag security challenges. It is organized as a dispatcher skill, solve-challenge, that triages a challenge by file type, keywords, and service behavior, then routes to one of nine specialized skills: web exploitation, binary pwn, cryptography, reverse engineering, forensics, OSINT, malware analysis, miscellaneous (jails, encodings, RF), and AI/ML attacks. An eleventh skill, ctf-writeup, generates standardized submission writeups. Each specialist ships a SKILL.md plus a set of technique reference files (107 in total) sourced from real, named competitions, and a central shell installer provisions the underlying security toolchain.

The Good

Unusual content depth, all of it sourced. The pack ships 123 markdown files totaling 53,892 lines. The technique files are not generic advice. Each entry names the competition it came from (VolgaCTF 2014, Boston Key Party 2016, SECUINSIDE 2017, CSAW 2018, Hack.lu CTF 2018, and so on) and ships the actual exploit: curl one-liners, pwntools scripts, format-string payloads, SQLi bypass strings. The web skill alone enumerates well over a hundred distinct techniques from specific CTFs. Files are deliberately capped near 800 lines and split when they exceed it, which keeps any single reference from becoming unscrollable.

Engineering rigor that is rare in this category. A 57-test pytest suite (1,616 subtests) passes in 0.33 seconds. The suite validates frontmatter on every SKILL.md, checks that cross-reference links resolve to real files, asserts skills are discoverable by their routing descriptions, and exercises the security auditor. CI runs on five fronts: tests, markdown lint, shell lint, a lychee link checker (weekly schedule plus on every push), and a skill security audit. A pre-commit config wires in trailing-whitespace fixes, yaml checks, large-file guards, ruff, shellcheck, and markdownlint-cli2.

A security scanner that understands its own domain. scripts/skill_security_auditor.py scans for destructive commands, pipe-to-shell patterns, hardcoded secrets, and risky eval/exec calls, but it is CTF-aware. It recognizes that AngularJS $eval('...') in a sandbox-escape payload is not a Python eval, that gdb's parse and eval is not code injection, and that placeholder hosts like attacker.com are expected. This domain-aware allowlisting is the difference between a scanner that screams at every CTF writeup and one that surfaces real problems.

Clean dispatcher architecture with honest routing. The solve-challenge SKILL.md is a 190-line playbook: recon, categorize (with a file-type-to-category map, a keyword map, and a service-behavior map), invoke the specialist, pivot when stuck, then write up. The specialist descriptions all carry explicit "Use when" and "Do not use when" guidance, which is what lets the dispatcher pick the right one. The misc skill even tells the agent to prefer a more specific skill first and only fall back to it for genuine edge cases.

The Bad

The live-solving path is unverified by necessity. The actual product is an agent reading these references and solving a challenge, which cannot be exercised without a live coding-agent session and the full native toolchain installed. I could test the supporting scripts and the structural suite, but not "did this flag get captured." That is an honest limitation of any doc-centric skill, and it is why functional verification is partial rather than yes.

Heavy, opinionated setup for the real toolchain. The installer is well built, but "all" mode pulls 30-plus pip packages (pwntools, angr, volatility3, z3-solver, qiling, frida-tools), 25-plus apt or brew packages (gdb, radare2, ghidra, wireshark, hashcat, qemu), Ruby gems, and a Go tool. Several need sudo and some (SageMath, pwndbg, pycdc, dnSpy) are documented as manual-only because they cannot be automated reliably. A user who only wants to read the techniques gets them for free, but a competition-ready environment is a real install.

Minor self-consistency and packaging blemishes. The in-repo security audit is not fully clean: ctf-web/server-side-exec-2.md line 629 carries a PHP exec() injection example flagged HIGH because it lacks the suppression marker the auditor itself defines. The pyproject.toml declares requires-python = ">=3.12" and a ruff target but omits the required [project].version field, which makes strict build tools (uv) reject it outright. There are no git release tags, so "Version: unreleased" is the only honest answer.

Smoke Test Results

Host-based testing on macOS aarch64 against a shallow clone. The pack is hybrid: a substantial doc pack plus working scripts, so the smoke section combines structural validation of the documentation with functional runs of the tooling scripts.

Structural validation ($ pytest / scripts run / result lines)

$ cd /tmp/ctf-skills-20260727 && python -m pytest tests/ -v
================ 57 passed, 1616 subtests passed in 0.33s ================ ✅

 test_skill_frontmatter.py all SKILL.md frontmatter valid ✅
 test_cross_references.py all internal links resolve ✅
 test_skill_discoverability.py skills discoverable by description ✅
 test_skill_security_auditor.py 35 auditor edge-case checks ✅

Run B. Functional verification of the tooling scripts

$ python -m scripts.skill_security_auditor ctf-web (1 HIGH finding on its own doc)
$ python -m scripts.skill_security_auditor ctf-pwn Verdict: PASS ✅
$ python -m scripts.generate_catalog
Catalog generated: _site/index.html: 11 skills, 107 technique files ✅
$ bash scripts/install_ctf_tools.sh --dry-run all
Installed: 0 Skipped: 3 Failed: 0 ✅
$ bash scripts/install_ctf_tools.sh --verify
Found: 8 tools/modules Missing: 50 (expected on a clean dev machine) ✅

Functional pass rate: 4 of 4 scripts. Every script that ships in the repo runs and produces correct output. The installer correctly reports the host state. The catalog generator produces a valid static site. The auditor correctly flags one finding in its own repo and passes the other ten skills.

What the runs tell you. The structural and tooling surface is solid and tested. What remains untested is the thing the documentation exists to enable: a live agent solving a real challenge with the full toolchain. That is a design property of doc-centric skills, not a defect in this one.

Full sandbox log →

Setup Walkthrough

1. Install all skills with the standard Agent Skills CLI: npx skills add ljagiello/ctf-skills. This drops the 11 skill directories into your agent's skills folder.
2. (Optional, before a competition) provision the toolchain: bash scripts/install_ctf_tools.sh all. Preview first with --dry-run all, and check your current state with --verify.
3. Install logs land in ~/.ctf-tools/. The script creates a dedicated venv when it detects a PEP 668 externally-managed Python, so it will not pollute your system Python.
4. Invoke the dispatcher in your agent with /solve-challenge . Specialists load on demand based on the routing descriptions.

Gotcha: the installer's python mode needs libgmp-dev (for gmpy2) on apt systems and installs it via sudo automatically. SageMath, pwndbg, pycdc, and dnSpy are manual-only and documented in scripts/install_ctf_tools.sh manual.

Alternatives

1. 0xSteph/pentest-ai - an MCP server for offensive-security workflows rather than a CTF technique library. Broader pentest scope, narrower technique depth per category. Prefer it for live engagement tooling; prefer ctf-skills for competition solving.
2. A standalone CTF writeup archive (e.g. CTFtime) - the same kind of sourced techniques, but not structured as agent-loadable skills with routing. Useful for human study, not for an agent to invoke on demand.
3. anthropics/skills - the official Anthropic pack includes a security-auditing skill, but it is oriented to defensive code review, not offensive CTF solving. Complementary rather than overlapping.