CTF Skills

A production-grade Claude Code plugin and Agent Skills repository that turns AI coding assistants into competitive Capture The Flag (CTF) security researchers. Built on real competition writeups from CTFTime, it equips agents with 124 modular technique guides, 10 verified exploit generator scripts, and a hierarchical multi-subagent team (ctf-solver team leader + 8 specialized category subagents).

Live Web Catalog: Explore all skills, techniques, and tools with instant search at naravid19.github.io/claude-ctf-skills.
Upstream Attribution: Core techniques based on ljagiello/ctf-skills (MIT). Write-up: lukasz.jagiello.org/projects/ctf-skills. Support the original author via GitHub Sponsors. Repackaged with Claude Code Plugin architecture, multi-subagent hierarchy, skill-scoped exploit scripts, and an interactive web catalog.

Architecture & How It Works

flowchart TD
    Target["CTF Challenge / Artifact\n(Binary, URL, PCAP, Crypto, etc.)"] --> ModeSelect{"Invocation Mode"}

    subgraph Orchestration ["Orchestration & Agent Layer"]
        ModeSelect -->|User Triage Command| Triage["/ctf-skills:solve-challenge\n(Triage & route to category)"]
        ModeSelect -->|Autonomous Team Leader| Solver["@ctf-skills:ctf-solver\n(Leader: analyzes, delegates, coordinates)"]
        ModeSelect -->|Direct Specialist Call| Specialists["Specialist Subagents (@ctf-pwn, @ctf-web, @ctf-crypto, etc.)"]
        ModeSelect -->|Context Auto-Detection| ModelSelect["Model-Invoked Selection\n(Agent auto-picks from prompt context)"]
    end

    Solver --> Specialists
    Triage --> CategorySkills
    Specialists --> CategorySkills
    ModelSelect --> CategorySkills

    subgraph CategorySkills ["Specialized Category Skills (skills/)"]
        Web["ctf-web (23 docs + async_fuzz)"]
        Pwn["ctf-pwn (21 docs + 5 scripts + 43 pwnable.tw writeups)"]
        Reverse["ctf-reverse (22 docs + Unicorn tracer)"]
        Crypto["ctf-crypto (20 docs + Padding Oracle & RSA suites)"]
        Forensics["ctf-forensics (15 docs)"]
        Misc["ctf-misc (13 docs incl. Pyjail & Bashjail)"]
        AIML["ctf-ai-ml (4 docs)"]
        Malware["ctf-malware (4 docs)"]
        OSINT["ctf-osint (4 docs)"]
        SimilarSearch["ctf-similar-search (Tavily writeup search)"]
    end

    subgraph ToolingLayer ["Execution & Exploit Tools"]
        PwnScripts["⚡ Pwn Exploit Generators\n(fmtstr, ret2libc, srop, seccomp ORW)"]
        WebScripts["⚡ Web Async Fuzzer\n(async_fuzz.py)"]
        CryptoScripts["⚡ Crypto Solvers\n(padding_oracle_suite.py, rsa_attack_suite.py)"]
        ReverseScripts["⚡ Reverse Emulators\n(unicorn_trace_emu.py)"]
        EnvTools["🛠️ System Tooling (scripts/install_ctf_tools.sh)\n(pwntools, Unicorn, Capstone, fpylll, gmpy2)"]
    end

    Pwn --> PwnScripts
    Web --> WebScripts
    Crypto --> CryptoScripts
    Reverse --> ReverseScripts

    CategorySkills --> FlagFound["🏁 Capture The Flag!"]
    FlagFound --> Writeup["/ctf-skills:ctf-writeup\n(Generate submission-grade writeup)"]

Core Design Principles

1. Model-Invoked Progressive Disclosure: You don't need to guess which attack applies. When Claude sees challenge source code or error logs, it selects the appropriate category (ctf-web, ctf-crypto, ctf-pwn) from semantic frontmatter descriptions and loads only the specific technique markdown files it needs.
2. Self-Contained Skill-Scoped Scripts: Ready-to-run exploit generators and fuzzers live directly inside skills/<category>/scripts/ so that each skill is completely portable.
3. Hierarchical Multi-Subagent Architecture: Complex challenges can be triaged by @ctf-solver and handed off to dedicated specialists (@ctf-pwn, @ctf-crypto, @ctf-web, etc.) without polluting the top-level conversation context.
4. Real Writeups, Not Synthetic Theory: Every technique is distilled from competitive CTFTime solutions, documenting the exact bypasses, edge cases, and oracles that worked under competition constraints.

Installation (30 Seconds)

Option 1: Claude Code Marketplace (Recommended)

This repository serves as its own Claude Code marketplace. In your terminal session:

/plugin marketplace add naravid19/claude-ctf-skills
/plugin install ctf-skills@claude-ctf-skills

Verify installation:

/plugins

Option 2: Skills Directory Plugin (Auto-loads in all projects)

Clone into your global Claude skills folder:

git clone https://github.com/naravid19/claude-ctf-skills ~/.claude/skills/ctf-skills

Run /reload-plugins inside Claude Code to activate immediately without restarting.

Option 3: Local Testing / Ad-Hoc Execution

Launch Claude Code with the plugin directory explicitly specified:

claude --plugin-dir /path/to/claude-ctf-skills

Option 4: Other Agents (Agent Skills Specification)

For environments supporting the Agent Skills standard:

npx skills add naravid19/claude-ctf-skills

What's Inside

1. Category Skills (Model-Invoked)

2. Orchestrator Skills & Subagents

Exploit & Automation Suite

The repository includes 10 ready-to-run, parameterized Python helper scripts stored directly inside skill subdirectories:

Binary Exploitation (skills/ctf-pwn/scripts/)

• fmtstr_payload_suite.py: Generator suite for format string vulnerabilities. Supports %p chain leak generator, arbitrary memory read, GOT overwrites, and single/short byte writes.
• ret2libc_two_stage.py: Automated two-stage ret2libc exploit using modern pwntools. Leaks libc address via puts/write, calculates base, and builds second-stage system("/bin/sh") payload.
• seccomp_orw_generator.py: Generates pure x86_64 Open-Read-Write (ORW) shellcode to read flags when execve is blocked by seccomp-bpf filters.
• shellcraft_asm.py: Lightweight assembly shellcode generator avoiding null bytes and custom forbidden characters.
• srop_execve.py: Constructs complete Sigreturn-Oriented Programming (SROP) SigreturnFrame payloads for x86_64 binaries with few ROP gadgets.

Web Fuzzing (skills/ctf-web/scripts/)

• async_fuzz.py: High-performance asynchronous endpoint and parameter fuzzer built with asyncio and aiohttp. Includes concurrency control, proxy support, regex flag matchers, and HTTP 429 adaptive backoff.

Cryptography (skills/ctf-crypto/scripts/)

• padding_oracle_suite.py: Automated CBC PKCS#7 padding oracle decryption and block encryption solver. Includes built-in mock oracle for verification.
• rsa_attack_suite.py: Multi-vector RSA cryptanalysis toolkit implementing Wiener's continued fractions attack, Fermat's close-prime factorization, Common Modulus attack, and Hastad's broadcast attack via CRT and integer root extraction.

Reverse Engineering (skills/ctf-reverse/scripts/)

• unicorn_trace_emu.py: In-memory CPU emulation tracer using Unicorn Engine. Safely executes x86/x64 shellcode in a virtual sandbox, tracing instructions, register states, and memory access without host execution risks.

Workflow Examples

1. Autonomous Team Leader & Specialist Delegation

Point the primary subagent at a challenge binary or web URL:

@ctf-skills:ctf-solver ./baby_pwn

The team leader runs in an isolated context:

1. Gathers file metadata (file, checksec, dynamic libraries).
2. Delegates to @ctf-skills:ctf-pwn or applies relevant technique playbooks.
3. Automatically writes and tests an exploit script using skills/ctf-pwn/scripts/.
4. Extracts the flag (flag{...}) and reports back to you.

2. Manual Investigation with Skill Routing

/ctf-skills:solve-challenge https://ctf.example.com/challenges/crypto_rsa

Routes immediately to ctf-crypto, guides you through factorizations using scripts/verify_crypto_examples.py, and suggests attacks (Wiener, Fermat, Coppersmith, or Boneh-Durfee).

3. Generate Submission Writeup

When the challenge is solved:

/ctf-skills:ctf-writeup

Emits a structured competition writeup containing challenge metadata, vulnerability analysis, reproduction steps, working exploit script, and key takeaways.

Environment Setup & Tool Installation

Skills operate out of the box with standard Python 3. For competitions requiring specialized binaries and libraries, run the automated environment installer:

bash scripts/install_ctf_tools.sh all

Modular Installation Groups

Installation logs and state are saved to ~/.ctf-tools/.

Testing & Quality Assurance

This repository maintains strict CI verification across all skills, scripts, and frontmatter:

# Run complete test suite (120 unit tests)
python -m pytest tests/ -v

# Verify skill frontmatter validity and required metadata
python -m pytest tests/test_skill_frontmatter.py -v

# Verify multi-subagent definitions
python -m pytest tests/test_agents.py -v

# Validate crypto and reverse exploit scripts
python -m pytest tests/test_crypto_scripts.py tests/test_reverse_scripts.py -v

# Validate all blob links in GitHub Pages catalog resolve
python -m pytest tests/test_catalog_links.py -v

# Syntax-check all Python crypto code blocks
python scripts/verify_crypto_examples.py

# Run security auditor across skills to check for credential leaks
python scripts/skill_security_auditor.py skills/ctf-web

Generating the Web Catalog

The static catalog is generated from skill frontmatter into _site/:

python scripts/generate_catalog.py

GitHub Actions automatically builds and deploys _site/ to GitHub Pages on every push to main.

Contributing

See CONTRIBUTING.md for detailed guidelines on formatting technique files, submitting pull requests, and passing the security audit.

Responsible Use & Security

This repository documents offensive cybersecurity techniques exclusively for authorized CTF competitions, educational purposes, and defensive security research. All contributors must adhere to SECURITY.md. Never include live targets, malicious infrastructure, or real user credentials.

License

MIT © 2026 Narawit. Original library © Lukasz Jagiello.