ljagiello/ctf-skills

What it is

ctf‑skills is a collection of Agent Skills – small, self‑contained knowledge modules that can be loaded by any AI‑agent platform that follows the Agent Skills spec (for example Claude Code). Each skill bundles together:

• a short description of a CTF (Capture‑the‑Flag) sub‑domain (web, binary‑pwn, crypto, reverse, forensics, OSINT, malware, etc.),
• the prerequisite tools needed to work on that sub‑domain, and
• a set of ready‑made scripts, cheat‑sheets and reference material that the agent can call while solving a challenge.

In short, it turns a large CTF knowledge base into a format an LLM‑driven agent can consume and act on.

---

Why it matters

CTF competitions are a common playground for security researchers and for training AI agents in adversarial reasoning. The biggest friction is tool‑setup – agents need a working compiler, debugger, crypto libraries, payload collections, etc. ctf‑skills solves this by:

• Providing a single installer (scripts/install_ctf_tools.sh) that can provision all the usual pentesting tools (Python packages, system packages via apt/brew, Go binaries, Ruby gems, etc.) in one go or in focused groups.
• Encoding the exact tool list each skill needs in a Prerequisites section, so an agent can request missing tools on‑the‑fly during a live competition.
• Packaging the massive PayloadsAllTheThings repository as an on‑demand shallow clone, keeping the repo lightweight while still giving agents access to a huge payload library.

Because the skills are written to the Agent Skills spec, any future LLM‑agent that supports that spec (Claude Code, upcoming OpenAI plugins, etc.) can immediately use the same knowledge base without custom integration work.

---

How to get started

1. Add the skill set to your agent

   npx skills add ljagiello/ctf-skills
   

   This registers the whole collection with your local Agent‑Skills runtime.

2. Install the required tooling (recommended before a competition)

   bash scripts/install_ctf_tools.sh all   # full install
   # or install only what you need, e.g.
   bash scripts/install_ctf_tools.sh python   # Python‑based tools only
   

   Use --dry-run to preview, --verify to check what’s already present, and --force to reinstall.

3. Run the orchestrator

   /solve-challenge <description or URL of the CTF problem>
   

   The orchestrator parses the challenge, picks the appropriate skill (e.g., ctf‑web for a SQLi), and calls the underlying scripts or cheat‑sheets.

4. Iterate – as the agent works, it will read the Prerequisites sections of each skill and, if a tool is missing, you can install it on‑demand with the same installer script.

---

Who should use it

Audience	Why it helps
CTF competitors	Stop spending time wiring up dozens of tools; the installer does it for you and the skill files give you ready‑made exploit templates.
Security educators / trainers	Provide students a reproducible, version‑controlled toolbox that works the same on every machine.
AI‑agent developers	A concrete, real‑world knowledge base that follows the Agent Skills spec, useful for training or evaluating LLM agents on security tasks.
Red‑team automation engineers	Plug the skill set into internal automation pipelines to auto‑generate initial exploit ideas or forensic triage steps.

---

Limitations & open questions

• Scope of automation – The repo supplies scripts, cheat‑sheets and payload references, but the actual exploit generation still relies on the LLM’s reasoning. It is not a fully‑automated one‑click pwn.
• Tool version drift – The installer pulls the latest versions of many system packages; reproducibility across years may require pinning versions manually.
• Agent‑spec dependency – To benefit, you need an agent that implements the Agent Skills spec (currently Claude Code is mentioned). Other platforms may need adapters.
• Security of the installer – Running a script that installs system packages and clones external repos should be audited before use in sensitive environments.

---

TL;DR

ctf‑skills turns the massive body of CTF knowledge (web, binary, crypto, forensics, OSINT, etc.) into Agent Skills that LLM‑driven agents can load. It ships a one‑command installer for all the usual pentesting tools and an orchestrator (/solve-challenge) that routes a challenge description to the right skill. Ideal for competitors, trainers, and anyone building AI agents that need a ready‑made security toolbox.