Loading
Solves CTF challenges by performing first-pass triage, identifying the dominant category, and routing execution to the right specialized ctf-* skill. Use when the user gives you a challenge bundle, a
The skill file stays in the publisher's repository.
Paste the copied command in a terminal. It installs this SKILL.md into that agent.
npx skills add ljagiello/ctf-skills --skill solve-challenge -a cursor -y
Solves CTF challenges by performing first-pass triage, identifying the dominant category, and routing execution to the right specialized ctf-* skill. Use when the user gives you a challenge bundle, a remote service, a suspicious file, or only a vague challenge description and you must determine where to start. Do not use it when the category is already clear and a specialized skill can be invoked directly; this is the dispatcher and recon entrypoint, not the deepest reference for category-specific techniques.
Solves CTF challenges by performing first-pass triage, identifying the dominant category, and routing execution to the right specialized ctf-* skill. Use when the user gives you a challenge bundle, a remote service, a suspicious file, or only a vague challenge description and you must determine where to start. Do not use it when the category is already clear and a specialized skill can be invoked directly; this is the dispatcher and recon entrypoint, not the deepest reference for category-specific techniques.
You're a skilled CTF player. Your goal is to solve the challenge and find the flag.
Two setup strategies depending on your workflow:
Use the central installer entrypoint:
bash scripts/install_ctf_tools.sh all
Run a narrower mode when you only want one tool group:
bash scripts/install_ctf_tools.sh python
bash scripts/install_ctf_tools.sh apt
bash scripts/install_ctf_tools.sh brew
bash scripts/install_ctf_tools.sh gems
bash scripts/install_ctf_tools.sh go
bash scripts/install_ctf_tools.sh manual
The full package lists now live in scripts/install_ctf_tools.sh.
Each category skill's SKILL.md has a Prerequisites section listing only the tools needed for that category. Install as you go.
If the CTF platform URL is known, check if it runs CTFd and switch to API-driven navigation:
# Detect CTFd (look for /api/v1/ and /themes/core/)
curl -s "$CTF_URL/api/v1/" | head -5
curl -s "$CTF_URL" | grep -oE '/themes/core/'
If CTFd is detected, ask the user for their API token (generated from CTFd Settings > Access Tokens). The token is not provided by default — the user must create one in the CTFd web UI first. Once provided, set the environment variables and proceed via API:
export CTF_URL="https://ctf.example.com"
export CTF_TOKEN="ctfd_..." # Ask user for this
Invoke /ctf-misc and load its ctfd-navigation.md for the full API reference and Python client class.
When the platform is not CTFd, has no usable API, or gates challenges behind a
JS-rendered UI / login, drive the platform in a real browser with Playwright
MCP (https://github.com/microsoft/playwright-mcp). This lets the agent read
challenge text, download attachments, keep a login session, and submit flags
directly through the site.
browser_navigate "https://ctf.example.com/challenges"
browser_snapshot # list challenges, points, categories (rendered)
browser_click <challenge ref> # open a challenge card
browser_snapshot # read description, hints, attachment links
browser_click <attachment ref> # download the challenge file (saved by the browser)
# ... solve the challenge ...
browser_type <flag input ref> "flag{...}"
browser_click <submit ref>
browser_find text="Correct" # cheaper than a full snapshot to check the verdict
browser_find (text or regex over the accessibility tree) is the right tool
whenever you only need to confirm one value — reserve full browser_snapshot
for when you need element refs to click or type into.
Login sessions (cookies/localStorage) persist across tool calls, so authenticate once and every later navigation is authorized. For general browser-automation tooling see ../ctf-web/tools-mcp.md.
Prefer a native API when one exists (CTFd token flow above is faster and more reliable); use Playwright MCP for platforms without an API or when the challenge list only renders client-side.
file * on everythingstrings, xxd | head, binwalk, checksec on binariesnc) to understand what they expectDetermine the primary category, then invoke the matching skill.
By file type:
.pcap, .pcapng, .evtx, .raw, .dd, .E01 -> forensics.elf, .exe, .so, .dll, binary with no extension -> reverse or pwn (check if remote service provided -- if yes, likely pwn).py, .sage, .txt with numbers -> crypto.apk, .wasm, .pyc -> reverse.safetensors, .pt, .pth, .bin, .onnx -> ai-mlBy challenge description keywords:
By service behavior:
Once you identify the category, invoke the matching skill to get specialized techniques:
| Category | Invoke | When to Use |
|---|---|---|
| Web | /ctf-web | XSS, SQLi, SSTI, SSRF, JWT, file uploads, prototype pollution |
| Pwn | /ctf-pwn | Buffer overflow, format string, heap, ROP, sandbox escape |
| Crypto | /ctf-crypto | RSA, AES, ECC, PRNG, ZKP, classical ciphers |
| Reverse | /ctf-reverse | Binary analysis, game clients, VMs, obfuscated code |
| Forensics | /ctf-forensics | Disk images, memory dumps, event logs, stego, network captures |
| OSINT | /ctf-osint | Social media, geolocation, DNS, public records |
| Malware | /ctf-malware | Obfuscated scripts, C2 traffic, PE/.NET analysis |
| AI/ML | /ctf-ai-ml | Model weights (.safetensors, .pt, .pth, .bin, .onnx), prompt injection, LoRA adapters, adversarial examples |
| Misc | /ctf-misc | Jails, encodings, RF/SDR, esoteric languages, constraint solving |
You can also invoke /ctf-<category> to load the full skill instructions with detailed techniques.
If your first approach doesn't work:
Common multi-category patterns:
After solving the challenge, invoke /ctf-writeup to generate a standardized submission-style writeup — concise, reproducible, and ready for competition organizers or teammates to validate.
Flags vary by CTF. Common formats:
flag{...}, FLAG{...}, CTF{...}, TEAM{...}ENO{...}, HTB{...}, picoCTF{...})Validation rule (important):
# Search for common flag patterns in files
grep -rniE '(flag|ctf|eno|htb|pico)\{' .
# Search in binary/memory output
strings output.bin | grep -iE '\{.*\}'
# Recon
file * # Identify file types
strings binary | grep -i flag # Quick string search
xxd binary | head -20 # Hex dump header
binwalk -e firmware.bin # Extract embedded files
checksec --file=binary # Check binary protections
# Connect
nc host port # Connect to challenge
echo -e "answer1\nanswer2" | nc host port # Scripted input
curl -v http://host:port/ # HTTP recon
# Python exploit template
python3 -c "
from pwn import *
r = remote('host', port)
r.interactive()
"
$ARGUMENTS