ctf-pwn

Provides binary exploitation techniques for CTF challenges. Use when you already have a vulnerable native target or service and need to turn memory corruption or low-level primitives into code execution or privilege escalation, such as buffer overflows, format strings, heap bugs, ROP, ret2libc, shellcode, kernel exploitation, seccomp bypass, sandbox escape, or Windows/Linux exploit chains. Do not use it when the main blocker is understanding what the binary does; use reverse engineering first. Do not use it for pure web bugs, disk or packet forensics, or standalone crypto/math challenges.

Quality

89%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-organized, highly actionable pwn reference that excels at executable commands and progressive disclosure through topical bundle files. Minor tightening of the dense resource index and adding explicit validation feedback loops in exploit workflows would lift it further.

Suggestions

Tighten the 'Additional Resources' section: the per-file technique enumerations are long; consider shortening each bullet to its core category and letting the referenced file carry the technique list.

Add explicit validate/retry feedback loops to multi-step exploit workflows (e.g., leak -> verify leak -> proceed) to strengthen workflow clarity for fragile operations.

Consider trimming or relocating the inline technique-specific callouts (e.g., exotic gadgets, specific syscall aliases) into their referenced files so the overview stays a lean index.

Dimension	Reasoning	Score
Conciseness	Mostly lean reference content with executable one-liners and no padding explaining basic concepts, but the long 'Additional Resources' listing of ~20 files with dense inline descriptions is somewhat heavy and could be tightened.	4 / 5
Actionability	Provides copy-paste ready commands (checksec, ROPgadget, cyclic, gdb) and concrete exploit-pattern recipes with specific gadgets and offsets, covering the common cases.	5 / 5
Workflow Clarity	Sequences are present (e.g., the stack overflow 5-step list, the protection decision tree) with practical checkpoints, but exploit workflows lack explicit validate-and-retry feedback loops for fragile operations.	4 / 5
Progressive Disclosure	Clear overview structure with one-level-deep references to ~20 topical .md files, each well-signaled via a descriptive 'Additional Resources' index plus inline 'See [file]' pointers throughout the body.	5 / 5
	Total	18 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, well-bounded description that clearly states both capabilities and trigger conditions with strong domain distinctiveness. Trigger phrasing leans technical rather than colloquial, keeping it just shy of a perfect score.

Dimension	Reasoning	Score
Specificity	Lists many concrete actions — 'buffer overflows, format strings, heap bugs, ROP, ret2libc, shellcode, kernel exploitation, seccomp bypass, sandbox escape, or Windows/Linux exploit chains' — with comprehensive coverage of the pwn domain.	5 / 5
Completeness	Explicitly answers both what ('Provides binary exploitation techniques... such as buffer overflows, format strings...') and when ('Use when you already have a vulnerable native target...'), with concrete trigger phrases.	5 / 5
Trigger Term Quality	Strong natural terms ('buffer overflow', 'ROP', 'ret2libc', 'shellcode') that CTF players say, but heavier on technical jargon than lay synonyms; a few natural phrasings are missing.	4 / 5
Distinctiveness Conflict Risk	Clear niche (native binary pwn) with explicit boundaries steering away from reverse engineering, web, forensics, and crypto skills, minimizing conflict risk.	5 / 5
	Total	19 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
relative_links	Relative link issues: 44 missing	Warning

	Total	14 / 16 Passed

Repository: ljagiello/ctf-skills
Path: ctf-pwn/SKILL.md
Commit: 36c72e5

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.