本文へ移動
cccskills
無料GitHub で公開

ctf-category

CTF challenge router - fingerprint a challenge (file type / prompt / artifacts) into its category (pwn, rev, crypto, forensics, stego, web, osint, hash) and route to the matching wiki page, tools, and first moves. Wiki-first.

Encod3d-Sec/TORCH
インストール方法を見る

含まれるファイル（1）

  • SKILL.md3.4 KB

SKILL.md（原文）

インストールする前に、エージェントに与えられる指示の中身を確認できます。

CTF Category Router

Given a challenge file or description, identify the category, then read the matching wiki page and apply its methodology. Always file the artifact and read the prompt before choosing.

Fingerprint -> route

SignalCategoryWiki pageFirst moves / tools
ELF/PE binary + "get a shell" / nc to a portpwn[[binary-exploitation]]checksec; find offset (cyclic); [[pwntools]] template; leak libc
Binary + "find the flag" / crackme / no networkrev[[reverse-engineering]]file,strings,checksec; [[radare2]]/Ghidra; ltrace; angr
n,e,c / .pem / cipher / "encrypt" / base-looking blobcrypto[[cryptography-attacks]], [[crypto-ctf-workflow]]identify primitive; RsaCtfTool; padding/XOR/hash-ext; CyberChef
.sol file / ABI+bytecode / contract address / web3 RPC endpointblockchain[[smart-contract-web3-attacks]], [[defi-amm-exploitation]][[slither]] static analysis; Foundry/Hardhat local fork to reproduce; flash-loan/AMM economic-exploit sims for DeFi
.pcap / .raw memory / disk image / .E01forensics[[digital-forensics]]file,binwalk; [[volatility]] (mem); [[wiki/tools/tshark]]/Wireshark (pcap)
Innocuous image/audio / "look closer"stego[[steganography]]exiftool,binwalk,strings; zsteg/steghide/stegseek; spectrogram
URL / web appwebexisting hunt skillsauto-triggers (sqli/xss/ssrf/idor/injection...) via triggers.json
Cloud creds/console (Azure TAP+SP, *.core.windows.net, AWS keys, GCP) - no ports, only a REST/console surfacecloud[[cloud-moc]], [[cloud-iam-attacks]]Skill(hunt-cloud): whoami; enumerate storage/SAS/blob + Key Vault (incl. prior secret versions) / IMDS - NOT the network-box driver
$hash / NTLM / shadow / zip2johnhash/crack[[hash-capture-and-cracking]]identify (hashid); [[wiki/tools/hashcat]] mode; [[password-cracking]]
"find the account/person/leak" / no fileosint[[persona-tracing]], [[secret-hunting]], [[web-attack-surface]]person pivots + photo geolocation; [[git-exposure]] for repos
python >>> jail / restricted shell / filtered interpretermisc/jail[[ctf-jail-escapes]]builtins/mro recovery, format-string pyjail, GTFOBins rbash escape

Procedure

  1. file challenge.*; read the prompt; note the remote (nc host port) if any.
  2. Match the strongest signal above (multiple may apply -> start with the most specific).
  3. qmd_query "<category> <specific tech>" -> read the wiki page; apply its methodology + payloads.
  4. Re-fingerprint every extracted artifact (stego/forensics nest: image -> zip -> binary).
  5. Flag found -> note the technique. Novel trick -> Wiki Feedback: update the category page so it is captured.

Self-heal

If a category page is missing or thin for the technique used, add a ## <technique> section (or stub the page) before moving on, so the gap fills. Pages: crypto/[[cryptography-attacks]], rev/[[reverse-engineering]], forensics/[[digital-forensics]], stego/[[steganography]], pwn/[[binary-exploitation]] + heap/[[heap-exploitation]], misc-jail/[[ctf-jail-escapes]].

Report: category chosen + flag/blocker + any wiki update.

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

ログインしてレビューを書く

同じリポジトリのスキル

概要と使いどころ

arsenal

無料

Wiki-first "what do I use" lookup - pick the automated TOOL (wiki/tools/), then the PAYLOAD/technique (wiki/payloads/ + wiki/cheatsheets/), for a surface/service/vuln-class BEFORE hand-rolling or working from memory. Use for "tool for <service>", "automated tools for web/<service>", "what should I run on <surface>", "which tool for <X>", "payloads for <X>", "payload arsenal", "cheatsheet for <X>", "how do I exploit <tech/class>", "exploit/attack chain for <X>", "arsenal", any SSRF/XSS/SQLi/SSTI/LFI/JWT/XXE/IDOR/NoSQL/deserialization/CSRF/CORS/CRLF/GraphQL/smuggling/web-cache/OAuth/SAML/MFA/crypto/LDAP/XPath/WebAuthn/file-upload/IMDS/prompt-injection/Modbus ask, plus "privesc arsenal", "CVE arsenal", "default creds", "nuclei templates", "sqlmap/hydra/nmap/bloodhound", "password attacks".

日本語の概要は準備中です。原文の説明を表示しています。

Encod3d-Sec/TORCH3302026年9月1日 更新

bb-workflow

無料

Autonomous bug-bounty campaign driver. Runs a full programme end to end with no operator approvals - the deterministic driver (scripts/campaign.py) owns pass state, generates the killchain board from recon, and prints the exact next action (including which Skill and tool to run) every turn. Use when starting or resuming a bug-bounty engagement, "run the bb workflow", "hunt this program", "9-pass campaign", or when handed a *.scope wildcard to test for TIER1 findings. Single agent, refuter-verified, wiki-first, tool-first.

日本語の概要は準備中です。原文の説明を表示しています。

Encod3d-Sec/TORCH3302026年9月1日 更新

campaign-health

無料

Health check for the bb/pt/ctf workflow driver subsystem - verifies everything is in place so every machine runs the same. Checks vault-content consistency (scripts present, JSON valid, routing wired, all 69 tool pages carry phase:, the tool index resolves, the hook edits are in place) AND per-machine wiring (the three workflow skills symlinked, hooks registered, imports work), then runs a live init->board->next smoke test. Use when setting up the workflow on a new machine, after a vault sync, when the driver misbehaves, or on "bb-health", "campaign health", "is the workflow set up", "check hooks and scripts", "why is the board not working".

日本語の概要は準備中です。原文の説明を表示しています。

Encod3d-Sec/TORCH3302026年9月1日 更新

chrome-devtools-browser

無料

Bring up a REAL, visible, interactive chromium on the Kali VM that the operator logs into (Smart-ID / Mobile-ID / any manual auth or MFA/CAPTCHA), while the agent drives and observes it live through the chrome-devtools MCP (navigate, DOM snapshot, network capture, screenshots, console, evaluate). Use whenever a target needs a MANUAL login the agent cannot complete headlessly, when you need to capture an authenticated session / the real API calls a page makes, or to confirm/screenshot a DOM-XSS. Triggers - "open a browser", "log in manually", "smart-id / mobile-id / national id login", "mfa / 2fa login", "solve the captcha", "drive the browser", "capture the authenticated session / network".

日本語の概要は準備中です。原文の説明を表示しています。

Encod3d-Sec/TORCH3302026年9月1日 更新

claude-md-improver

無料

OFFLINE FALLBACK for the claude-md-management plugin - prefer that plugin when it is installed. Audit and improve CLAUDE.md files - scan for CLAUDE.md files, evaluate quality against templates, output a report, then make targeted updates. Invoke explicitly (/claude-md-improver) when the plugin is unavailable.

日本語の概要は準備中です。原文の説明を表示しています。

Encod3d-Sec/TORCH3302026年9月1日 更新

coverage

無料

Show per-asset vuln-class coverage gaps for the active engagement so nothing in scope is skipped. Use when asked "coverage", "what haven't we tested", "test gaps", "are we thorough", or before calling an engagement done.

日本語の概要は準備中です。原文の説明を表示しています。

Encod3d-Sec/TORCH3302026年9月1日 更新

Encod3d-Sec のスキルをすべて見る

このスキルの問題を報告する