Updated today
by ljagiello
ctf-skills
Agent skills for solving CTF challenges - web exploitation, binary pwn, crypto, reverse engineering, forensics, OSINT, and more
3.5k GitHub stars (3,459)
+105 in 20 days
| Period | New stars |
|---|---|
| Sep 27 | 0 |
| Sep 28 | +4 |
| Sep 29 | +11 |
| Sep 30 | +9 |
| Oct 1 | 0 |
| Oct 2 | +3 |
| Oct 3 | 0 |
| Oct 4 | +4 |
| Oct 5 | +8 |
| Oct 6 | +1 |
| Oct 7 | +3 |
| Oct 8 | +5 |
| Oct 9 | +11 |
| Oct 10 | +7 |
| Oct 11 | +6 |
| Oct 12 | +3 |
| Oct 13 | +4 |
| Oct 14 | +6 |
| Oct 15 | +9 |
| Oct 16 | +11 |
- 11 skills (11 skills found in its SKILL.md files)
- 400 forks (400 forks)
- Today last update (Last updated today)
Install
Skills CLI
npx skills add ljagiello/ctf-skills
Asks which skills and agents to install. Just one: npx skills add ljagiello/ctf-skills --skill ctf-ai-ml — add -g for every project.
Claude Code
git clone https://github.com/ljagiello/ctf-skillscp -r "ctf-skills/ctf-ai-ml" ~/.claude/skills/
Copies the ctf-ai-ml skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project). Repeat for the other skills listed below.
Plugin
/plugin marketplace add ljagiello/ctf-skills
Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.
Skills can run code on your machine — read the SKILL.md first.
What it does
In the author's own words, from each skill's SKILL.md.
-
ctf-ai-ml
Provides AI and machine learning techniques for CTF challenges. Use when attacking ML models, crafting adversarial examples, performing model extraction, prompt injection, membership inference, training data poisoning, fine-tuning manipulation, neural network analysis, LoRA adapter exploitation, LLM jailbreaking, or solving AI-related puzzles.
ctf-ai-ml/SKILL.md on GitHub (opens in a new tab) -
ctf-crypto
Provides cryptography attack techniques for CTF challenges. Use when attacking encryption, hashing, signatures, ZKP, PRNG, or mathematical crypto problems involving RSA, AES, ECC, lattices, LWE, CVP, number theory, Coppersmith, Pollard, Wiener, padding oracle, GCM, key derivation, or stream/block cipher weaknesses.
ctf-crypto/SKILL.md on GitHub (opens in a new tab) -
ctf-forensics
Provides digital forensics and signal analysis techniques for CTF challenges. Use when analyzing disk images, memory dumps, event logs, network captures, cryptocurrency transactions, steganography, PDF analysis, Windows registry, Volatility, PCAP, Docker images, coredumps, side-channel power traces, DTMF audio spectrograms, packet timing analysis, CD audio disc images, or recovering deleted files…
ctf-forensics/SKILL.md on GitHub (opens in a new tab) -
ctf-malware
Provides malware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES encrypted communications, YARA rules, shellcode analysis, memory forensics for malware (Volatility malfind, process injection detection), anti-analysis techniques (VM/sandbox detection, timing evasion…
ctf-malware/SKILL.md on GitHub (opens in a new tab) -
ctf-misc
Provides miscellaneous CTF challenge techniques for problems that do not cleanly fit the main categories. Use for encoding puzzles, pyjails, bash jails, RF/SDR, DNS oddities, unicode tricks, esoteric languages, QR or audio puzzles, constraint solving, game theory, unusual sandbox escapes, and hybrid logic puzzles. Prefer a more specific skill first when the challenge is mainly web, pwn, reverse,…
ctf-misc/SKILL.md on GitHub (opens in a new tab) -
ctf-osint
Provides open source intelligence techniques for CTF challenges. Use when gathering information from public sources, social media, geolocation, DNS records, username enumeration, reverse image search, Google dorking, Wayback Machine, Tor relays, FEC filings, or identifying unknown data like hashes and coordinates.
ctf-osint/SKILL.md on GitHub (opens in a new tab) -
ctf-pwn
Provides binary exploitation techniques for CTF challenges. Use when you already have a vulnerable native target or service and need to turn memory corruption or low-level primitives into code execution or privilege escalation, such as buffer overflows, format strings, heap bugs, ROP, ret2libc, shellcode, kernel exploitation, seccomp bypass, sandbox escape, or Windows/Linux exploit chains. Do not…
ctf-pwn/SKILL.md on GitHub (opens in a new tab) -
ctf-reverse
Provides reverse engineering techniques for CTF challenges. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, game clients, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and t…
ctf-reverse/SKILL.md on GitHub (opens in a new tab) -
ctf-web
Provides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client, template engine, identity flow, or smart-contract frontend/backend surface, including XSS, SQLi, SSTI, SSRF, XXE, JWT, auth bypass, file upload, request smuggling, OAuth/OIDC, SAML, prototype pollution, and similar web bugs. Do not use it for native binary memory cor…
ctf-web/SKILL.md on GitHub (opens in a new tab) -
ctf-writeup
Generates a single standardized submission-style CTF writeup for competition handoff and organizer review. Use after solving a CTF challenge to document the solution steps, tools used, and lessons learned in a structured format.
ctf-writeup/SKILL.md on GitHub (opens in a new tab) -
solve-challenge
Solves CTF challenges by performing first-pass triage, identifying the dominant category, and routing execution to the right specialized ctf-* skill. Use when the user gives you a challenge bundle, a remote service, a suspicious file, or only a vague challenge description and you must determine where to start. Do not use it when the category is already clear and a specialized skill can be invoked…
solve-challenge/SKILL.md on GitHub (opens in a new tab)
No skill matches that filter.
Review before you install
A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.