ctf-skills: Nine Category Skills for Capture the Flag

Capture the flag rewards breadth: one event can span SQL injection, heap exploitation, RSA pitfalls, disk forensics, and steganography, and no human is deep in all of them. ljagiello/ctf-skills hands that breadth to your coding agent — nine category skills covering web exploitation, binary pwn, crypto, reverse engineering, forensics, OSINT, malware analysis, AI/ML attacks, and misc techniques, built for any tool that supports the Agent Skills spec.

Why This Skill Matters

Each category gets its own skill with its own technique catalog. The ctf-web row alone names patterns from php://filter LFI and prototype pollution to JWT JWK/JKU/KID injection and SSTI bypasses. The README's table lists nine category skills — ctf-web, ctf-pwn, ctf-crypto, ctf-reverse, ctf-forensics, ctf-osint, ctf-malware, ctf-ai-ml, and ctf-misc — plus two more rows: solve-challenge, an orchestrator that analyzes a challenge and delegates to the category skills, and ctf-writeup, which generates standardized writeups.

The practical differentiator is the environment story. Every skill's SKILL.md carries a Prerequisites section listing only the tools that category needs, so your agent can install what a challenge requires on demand instead of you maintaining a king-size toolchain year-round.

Installation

One command adds the whole collection:

npx skills add ljagiello/ctf-skills

Real Workflow: Prepping Before a Competition

The repo ships a central installer for the tooling every category draws on. Preview first — it skips anything already present:

bash scripts/install_ctf_tools.sh --dry-run all

Then install for real, or run a narrower group — python, apt, brew, gems, go, or manual — if you only need one slice:

bash scripts/install_ctf_tools.sh all

Verify what landed and check the logs in ~/.ctf-tools/:

bash scripts/install_ctf_tools.sh --verify

Real Workflow: Inside a Challenge

Once the skills are installed, work the challenge in your agent's normal flow. For a web task you might prompt:

This challenge serves a login page at http://localhost:8080.
Work it as a CTF web challenge: probe for injection and auth
bypasses, and capture the flag.

The ctf-web skill puts its technique catalog in the agent's context, so injection and bypass patterns surface while you stay on triage and validation. If the agent hits a missing tool, the skill's Prerequisites section names what to install, so you can keep moving instead of googling package names mid-event.

Tips

• Run the installer's --dry-run before a competition weekend so nothing surprises you at 2 a.m.
• Prefer on-demand installs? Skip the bulk installer and let each skill's Prerequisites section drive setup.
• The README documents a Friday Studio integration if you want scheduled, logged challenge workspaces.
• Combine categories deliberately: forensics findings often hand the crypto skill its next input.

When Not to Use This

These are CTF playbooks — use them on competition targets and lab machines you are authorized to attack. For production security work you want your org's own review process, not a competitive exploit catalog. And if you never touch binary exploitation or forensics, the full toolchain install is dead weight; install only the categories you actually play.

See the leaderboard for more skills.