CtrlK
BlogDocsLog inGet started
Tessl Logo

competition-crypto-mobile

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for crypto, encoding, steganography, APK, IPA, and mobile trust-boundary challenges. Use when the user asks to decode a blob, recover a transform chain or key, inspect hidden media payloads, hook an APK or IPA signer, inspect app storage, or replay mobile request-signing logic. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

70

Quality

86%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

High

Do not use without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

72%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is concise and well-structured with a clear progressive-disclosure layout pointing to a single real reference. Its weak spots are actionability and workflow clarity, where guidance lists targets and an ordered chain but lacks executable tooling and an explicit validation/retry loop.

Suggestions

Add one or two concrete tool invocations per path (e.g., a specific apktool/frida/jadx command or a one-line Python decode snippet) so the mobile and crypto steps are copy-paste actionable rather than descriptive.

Make the validation step explicit with a feedback loop: after attempting a decode or hook, state what to check (reproduced artifact / accepted branch) and what to do when it fails before retrying.

Name specific tools or commands alongside the inspection targets in the Stego and Mobile sections (e.g., 'binwalk for trailers', 'apksigner verify', 'frida-trace on the signer') to lift actionability.

DimensionReasoningScore

Conciseness

The body is lean and imperative with no padding or explanation of concepts Claude already knows; every line ('Keep exact keys, IVs, nonces, salts, tags, offsets, and byte order', 'Hook the narrowest mobile boundary that proves the behavior') earns its place.

3 / 3

Actionability

It names concrete inspection targets (LSBs, alpha planes, chunk layout, exported components, deeplinks, native bridge calls) but provides no executable commands, tool names, or copy-paste examples, and several bullets ('Rank decode attempts by evidence', 'Reproduce the plaintext') are high-level directives rather than instructions.

2 / 3

Workflow Clarity

A clear ordered sequence exists (Quick Start steps 1-5 and the container→compression→encoding→xor/sub→crypto→integrity→parse chain), but validation is mostly implicit ('Reproduce the plaintext, payload, signed request, or accepted branch') with no explicit validate→fix→retry feedback loop.

2 / 3

Progressive Disclosure

A short overview (under 50 lines) points cleanly to one real one-level-deep reference ('Load references/crypto-mobile.md') plus sibling skills, with well-organized sections and easy navigation.

3 / 3

Total

10

/

12

Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, well-triggered, complete, and distinct, naming concrete actions and an explicit 'Use when' clause while scoping itself as a downstream specialization. No meaningful weaknesses; the third-person voice is maintained throughout.

DimensionReasoningScore

Specificity

Lists multiple concrete actions such as 'decode a blob, recover a transform chain or key, inspect hidden media payloads, hook an APK or IPA signer, inspect app storage, or replay mobile request-signing logic', matching the anchor for enumerating specific concrete actions rather than vague language.

3 / 3

Completeness

Explicitly states what it does ('CTF-sandbox workflow for crypto, encoding, steganography, APK, IPA, and mobile trust-boundary challenges') and when to use it via an explicit 'Use when the user asks...' clause, satisfying both halves.

3 / 3

Trigger Term Quality

Includes natural phrasings a CTF user would actually say ('decode a blob', 'inspect hidden media payloads', 'hook an APK or IPA signer', 'inspect app storage', 'replay mobile request-signing logic'), giving good coverage rather than only abstract jargon.

3 / 3

Distinctiveness Conflict Risk

Occupies a clear niche (CTF crypto/stego/mobile) with distinct triggers and an explicit guard that it is downstream of '$ctf-sandbox-orchestrator', making conflict with unrelated skills unlikely.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
zhaoxuya520/reverse-skill
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.