ljagiello/ctf-skills

What it solves

ctf-skills provides a comprehensive library of specialized capabilities (skills) for AI agents to solve Capture The Flag (CTF) challenges. It bridges the gap between a general-purpose LLM and the highly technical, domain-specific requirements of cybersecurity competitions, covering areas like web exploitation, binary pwn, cryptography, and reverse engineering.

How it works

The project implements the "Agent Skills" specification, allowing these capabilities to be integrated into AI agents. It provides a set of predefined skills categorized by CTF domain (e.g., ctf-web, ctf-pwn, ctf-ai-ml). Each skill includes a description and a list of prerequisites—specific tools and libraries—that the agent needs to install to execute the tasks associated with that skill.

To ensure the agent has the necessary environment, the project includes installation scripts (install_ctf_tools.sh) to pre-install tool groups (Python, apt, brew, gems, go) or allow the agent to install tools on-demand as it encounters missing dependencies during a challenge.

Who it’s for

Security researchers, CTF players, and developers building AI-powered security agents. It is designed to work with tools that support the Agent Skills spec, such as Claude Code or the Friday Studio workspace runtime.

Highlights

• Broad Domain Coverage: Includes specialized skills for web exploitation (SQLi, XSS, SSRF, JWT), binary pwn (Buffer overflow, ROP, heap exploitation, kernel exploitation), cryptography (RSA, AES, ECC, PRNG), and AI/ML security (adversarial examples, prompt injection, jailbreaking).
• Agent-Native Design: Built specifically for AI agents to load and use on-demand based on skill descriptions.
• Comprehensive Tooling: Provides automated scripts to set up the complex environment of tools required for professional CTF work.
• ** uma reproducible workspace integration**: Compatible with Friday Studio for running skills in logged, reproducible local workspaces.