CTF Super Hub — What It Is and How It Works

In one sentence

CTF Super Hub is a beginner-friendly "front door" for CTF (Capture The Flag) and reverse-engineering challenges — it tells an AI assistant how to guide you through a challenge step by step, starting from "I have no idea what to do."

It is not a collection of tools, not a question bank, and not something you need to code. It is a set of skills — think of a skill as a written playbook that tells an AI: "when the user gives you a challenge, follow this procedure."

---

The problem it solves

The README states the core problem plainly: "It's not that you lack tools — it's that when you get a challenge, you often don't know what the first step should be."

Typical beginner pain points it addresses:

• Can't tell whether a challenge is Web, Crypto, Reverse, Pwn, or Misc
• Sees many skill names but doesn't know which one to invoke first
• Doesn't know what first command to type
• Wants the AI to walk them through step by step instead of dumping jargon
• Wants different output styles (teaching vs. competition vs. hints-only)

---

Two entry points (you only need to remember these two)

1. ctf-super-hub (default, recommended for most people)

This is the single orchestration center of the whole repo. It:

• Automatically guesses which challenge category the problem looks like
• If there isn't enough information, runs a minimal brainstorm with you first
• Switches between three output styles: teaching, competition, hints-only
• Scans which skills are actually installed on your machine and only routes to those (it never recommends a skill you didn't install)
• Can hand off to strix-* skills for web / interface / vulnerability-verification work
• Supports team formation: 1 main role + up to 2 assistants

2. ctf-beginner-hub (for pure novices)

A gentler variant of the main entry. Same routing rules, but it explains terms in plain language and gives a short tutorial first. Use this if you're brand new or easily overwhelmed by jargon.

---

How it works: two modes

Mode 1 — Auto-routing

Use this when you already have materials: challenge text, attachments, a URL, IP:PORT, source code, or a binary file. It does three things:

1. Judges which category the challenge most resembles
2. Decides whether to switch to a more specific ctf-* or strix-* skill
3. Tells you only the next 1–3 most worthwhile steps

Mode 2 — Brainstorm first, then route

Use this when you don't understand the challenge at all, don't know if your materials are enough, or don't know what information to gather next. It does three things:

1. Helps you clarify the goal
2. Organizes clues and missing information
3. Then decides which skill to call

---

What strix-* is

It's an enhancement layer, not a second main system. The main flow is handled by ctf-super-hub / ctf-beginner-hub; strix-* only steps in for web, interface, and vulnerability-verification actions. You don't need to memorize the strix-* names — the main entry handles that.

---

Two rules that keep it from going off track

1. Handoff contract: A skill doesn't move to the next step until its current task is done. It only returns to the orchestration center when you explicitly ask "what's next?" — it won't chain through skills on its own.
2. Installation-aware routing: The orchestration center scans what's actually installed before recommending anything. Uninstalled skills are never suggested.

---

How to use it (quick start)

1. Install the skill folders into your AI tool's skills directory (Codex, Claude Code, Gemini CLI, or OpenCode — pick the one you use).
2. Start a new conversation (old, long conversations are less reliable).
3. Paste a starter prompt like:

   "Please use ctf-super-hub to help me with this challenge. If you can determine the type, auto-route to the most suitable ctf-* skill. If information is insufficient, first do minimal brainstorming with me. Default to teaching style."

4. Paste whatever materials you have — challenge text, URL, IP:PORT, attachments, source code, commands you've already tried, where you're stuck. You don't need to organize it perfectly.
5. Follow its next-step instructions. If it says it needs more info, that's normal — it's working, not broken.

You can also request specific styles: teaching (more explanation), competition (fast progress), or hints-only (just hints, no full solutions).

---

Installation (briefly)

• Codex (recommended, easiest): run the built-in script ./install-to-codex.sh from the repo root. It creates the target directory, backs up any existing same-named skills, and copies everything.
• Claude Code / Gemini CLI / OpenCode: manually copy the folders brainstorming, solve-challenge, ctf-*, strix-* into the tool's skills directory (e.g., ~/.claude/skills, ~/.gemini/skills, ~/.opencode/skills).
• After installing, restart the tool or open a new session.

To verify installation: check that ctf-super-hub/SKILL.md exists in your skills directory, or start a new session and test with a dummy challenge.

---

Version checking and updates

Since v1.1.0, the main entry checks for updates automatically:

• On each entry, it reads UPDATE.json and makes at most one network request per 24 hours (failures are silent and don't affect usage)
• If a new version exists, a 🔔 reminder appears with the version number and notes
• Replying 1 right after that reminder triggers the update script (pull + re-sync all skills)
• If you have uncommitted local changes to skills, the update refuses to run and lists the files — it won't overwrite your work
• Manual update is also possible via scripts/update_skills.sh (with a --dry-run flag to preview)

---

Quality assurance

The repo has a three-level validation system:

• L1 — Structural validation: python3 scripts/validate_skills.py checks all 35 skills' frontmatter, description trigger names, relative links, Python script syntax, and key repo files. Supports --json for CI integration.
• L2 — Behavior smoke tests / L3 — held-out regression: evals/hub-routing/ contains 5 blind test scenarios (RSA classification, SQLi enhancement, OSINT counterexample, combined orchestration, reverse/pwn held-out). Executors who don't know the expected answers run real routing, then a judge + human review scores the results. After any routing-rule change, all tests are re-run; the fixtures serve as regression baselines.
• Lightweight audit: leaf-skill slimming principles are documented in docs/skill-weight-audit.md.

---

Key facts to remember

• You don't need to learn challenge-type classification first — that's the whole point.
• You don't need to memorize skill names — just remember ctf-super-hub and ctf-beginner-hub.
• Installing only the main entry is not recommended — the main entry's value comes from routing to the other skills. Install brainstorming, solve-challenge, ctf-*, and strix-* together.
• A single URL, zip file, or ELF binary is enough to start — you don't need complete information upfront.
• "I need more info" is a good sign — it means the system is working.
• Antivirus false positives are expected: the repo contains no executables — only Markdown docs, two readable shell scripts (one copies skill folders, one checks/prints which tools need installing), and a Python validation script. The security-education content can trigger heuristic detection; whitelist it if it comes from the official repo.

---

Repo structure (what matters to you)

You only really need to care about three things:

• ctf-super-hub/ — the main orchestration center
• ctf-beginner-hub/ — the beginner variant
• START-HERE.md — the quick-start guide

The rest (ctf-*/ category skills, strix-*/ enhancement layer, solve-challenge/, brainstorming/, scripts/, evals/, docs/) supports the system but doesn't need your attention as a user.

---

Community

GitHub handles distribution; the LinuxDo community handles Chinese-language feedback and discussion. The project invites contributions via issues/PRs and community feedback on which steps are most confusing.

Bottom line: This project doesn't try to give you more skills — it tries to solve the hardest part for beginners: getting started on a challenge when you don't know where to begin.