ctf-triage

CTF challenge triage and solve methodology — category detection, tool selection, and multi-step solve chains across pwn/rev/crypto/forensics/web/misc.

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

80%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill is exceptionally actionable and concise, with copy-paste-ready tooling across every CTF category. Its weaknesses are the absence of explicit validation/feedback checkpoints in destructive workflows and the lack of a progressive-disclosure file structure separating the long per-phase reference material out of SKILL.md.

Suggestions

Add explicit validation checkpoints to the destructive/batch phases (e.g. after a libc leak, validate the leaked address aligns to a known page before building the ROP chain; after binwalk -eM, verify extracted layers before re-triaging; confirm flag format before submitting).

Move the detailed per-phase command catalogs into reference files (e.g. references/pwn.md, references/crypto.md) and keep SKILL.md as a triage overview with one-level-deep pointers, improving progressive disclosure and token efficiency at load time.

Dimension	Reasoning	Score
Conciseness	The body is lean and command-driven: triage tables, fenced one-liners, and minimal prose, assuming Claude's competence (e.g. 'Identify challenge category before touching any tool'). No padding or explanation of concepts Claude already knows, matching the lean-and-efficient anchor.	5 / 5
Actionability	It provides copy-paste-ready bash and python snippets across all categories (file/xxd/binwalk triage, pwntools exploit skeletons, angr symbolic execution, tshark extraction, volatility profiles, hashcat modes), covering the common CTF cases with executable commands.	5 / 5
Workflow Clarity	A clear Phase 0→6 sequence exists with a summary workflow, and Phase 0 triage table routes to the right phase; however the destructive/batch operations (exploitation, recursive extraction, hash cracking) lack explicit validate-checkpoint/feedback loops (e.g. verify the flag format or confirm a leak before building the ROP chain), which caps clarity at 3 per the feedback-loops note.	3 / 5
Progressive Disclosure	Content is well sectioned by phase, but everything is inlined into SKILL.md with no bundle files in references/scripts/assets; the only external pointer ('reverser/packer-unpacking/SKILL.md') is to a sibling skill, not a bundled reference, so it sits at 'some structure, references not clearly signaled / content that should be separate is inline'.	3 / 5
	Total	16 / 20 Passed

Description

86%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, distinctive, and rich in natural trigger terms, with the when-guidance supplied via when_to_use metadata. It would reach a 5 on completeness if an explicit 'Use when...' clause were folded into the description field itself rather than only metadata.

Suggestions

Add an explicit 'Use when ...' sentence directly in the description field (not just metadata.when_to_use) so the trigger guidance is visible wherever the description is shown.

Optionally surface the concrete category actions (triage, exploit, decode, extract) in the description to lift specificity toward the comprehensive anchor.

Dimension	Reasoning	Score
Specificity	Names several concrete actions ('category detection, tool selection, and multi-step solve chains') but describes methodology at a level slightly above the most granular anchor; it does not enumerate the full breadth of actions the body covers, so it sits at 'several specific actions; minor gaps' rather than 5.	4 / 5
Completeness	It clearly states what the skill does in the description, and metadata.when_to_use supplies the when; however the 'when' guidance lives in metadata rather than an explicit 'Use when...' clause in the description field itself, so it is present but not as explicit as the 5 anchor.	4 / 5
Trigger Term Quality	The when_to_use metadata lists comprehensive natural terms including synonyms and category names ('CTF, capture the flag, pwn, rev, crypto challenge, forensics challenge, steganography, flag, challenge file, binary exploit'), matching the comprehensive-coverage-with-synonyms anchor.	5 / 5
Distinctiveness Conflict Risk	The CTF triage niche is highly specific with distinct triggers (pwn/rev/crypto/forensics/web/misc categories) and minimal overlap risk with general skills, matching the clear-niche-with-distinct-triggers anchor.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/reverser/ctf-triage/SKILL.md
Commit: 31e1c8e

Reviewed: 15 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.