CtrlK
BlogDocsLog inGet started
Tessl Logo

ctf-sandbox-orchestrator

Default entrypoint and master ctf-sandbox-orchestrator workflow for CTF, exploit, reverse engineering, DFIR, pwnable, crypto, stego, mobile, AI-agent, cloud, container, Active Directory, Windows-host, and identity challenges. Use first when the user presents challenge infrastructure, binaries, prompts, hosts, or identities that should be treated as sandbox-internal by default and Codex needs to choose, route, and load the right downstream analysis path with concise evidence.

66

Quality

79%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

67%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured orchestration skill body with a clear phased workflow, concrete directive templates, and properly split one-level reference files. Its main weakness is conciseness: a large inlined child-skill list duplicates the router-matrix reference and an unreferenced digest file signals an organization gap.

Suggestions

Move the inlined $competition-* child-skill list (lines 69-109) into references/router-matrix.md (which already holds the routing matrix) and replace it with a single pointer, eliminating the duplication and reclaiming roughly 40 lines of token budget.

Either reference references/ctf-resources-digest.md from the body (e.g., in the Expand By Challenge Type or Verify And Report section) or remove it from the bundle so every reference file is reachable from the overview.

Tighten the validation guidance in the Verify And Report phase into an explicit validate -> fix -> re-run loop (e.g., 'if reproduction fails, return to step 2 and isolate one variable') to lift workflow clarity toward anchor 5.

DimensionReasoningScore

Conciseness

The body is mostly lean and assumes Claude's competence (no concept padding), but the ~40-item inlined $competition-* child-skill list (lines 69-109) duplicates the routing already in references/router-matrix.md, which is a non-minor padded section that could be trimmed.

3 / 5

Actionability

Provides concrete directive templates ("host -> proxy -> process/container -> persistence layer -> downstream worker"), specific evidence-recording lists, and explicit per-domain file routing; minor gaps remain in that some directives defer execution detail to child skills.

4 / 5

Workflow Clarity

Clear four-phase sequence (Establish -> Trace -> Expand -> Verify) with a Quick Start, a re-route feedback loop, and a "re-run from clean baseline before calling solved" checkpoint; validation is present but more high-level than the explicit validate-fix-retry loop of anchor 5.

4 / 5

Progressive Disclosure

Clear overview with well-signaled one-level-deep references (all seven referenced files exist) and easy per-domain navigation, but the inlined child-skill list belongs in router-matrix.md and references/ctf-resources-digest.md is never referenced from the body, leaving minor organization gaps.

4 / 5

Total

15

/

20

Passed

Description

91%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-structured router description that explicitly states both capability and trigger conditions with comprehensive natural keyword coverage. It is held back only by somewhat abstract action verbs and inherent overlap with the child skills it routes to.

DimensionReasoningScore

Specificity

Lists several concrete router actions ("choose, route, and load the right downstream analysis path") plus a comprehensive domain list, but the verbs are abstract meta-routing actions rather than concrete analytical operations, so it stops short of anchor 5.

4 / 5

Completeness

Explicitly answers both what ("Default entrypoint and master ... workflow") and when ("Use first when the user presents challenge infrastructure, binaries, prompts, hosts, or identities") with concrete trigger phrases.

5 / 5

Trigger Term Quality

Comprehensive natural-term coverage ("CTF, exploit, reverse engineering, DFIR, pwnable, crypto, stego, mobile, AI-agent, cloud, container, Active Directory, Windows-host, identity") plus concrete trigger objects ("binaries, prompts, hosts, identities") that users would naturally say.

5 / 5

Distinctiveness Conflict Risk

Has a clear router niche with the distinctive "sandbox-internal by default" framing, but shares domain vocabulary with the many child competition-* skills it lists, creating minor overlap risk; not a fully isolated niche.

4 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
zhaoxuya520/reverse-skill
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.