Solve Challenge

What it does

When your agent uses it

• The user gives you a challenge bundle
• A remote service
• A suspicious file
• Only a vague challenge description and you must determine where to start

Example prompts

• “Use the solve-challenge skill to solve CTF challenges by performing first-pass triage, identifying the dominant category, and routing execution to…”
• “/solve-challenge”

Requirements

• Python 3
• A credential in CTF_TOKEN
• Compatibility (from SKILL.md): Requires filesystem-based agent (Claude Code or similar) with bash, Python 3, and internet access. Orchestrates other ctf-* skills.
• Pre-approved tools (allowed-tools): Bash, Read, Write, Edit, Glob, Grep, Task, WebFetch, WebSearch, Skill

Workflow steps

6 steps, taken from the step headings in SKILL.md.

1. 1CTFd Platform Detection
2. 2Recon
3. 3Categorize
4. 4Invoke the Category Skill
5. 5Pivot When Stuck
6. 6Generate Write-up

What it can do on your machine

Read from SKILL.md and the folder at commit c332c7b. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Bash
  • Read
  • Write
  • Edit
  • Glob
  • Grep
  • Task
  • WebFetch
  • WebSearch
  • Skill

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Shell commands in SKILL.md call:

  • bash
  • curl
  • python3

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md. Its commands use curl, which can reach the network depending on how they are called.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names these keys or tokens, usually read from environment variables:

  • CTF_TOKEN

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

• Compatibility

  Requires filesystem-based agent (Claude Code or similar) with bash, Python 3, and internet access. Orchestrates other ctf-* skills.

  From compatibility in the SKILL.md frontmatter.

Context cost

Solve Challenge loads about 2.3k tokens when it runs. Until then it costs about 133 tokens; SKILL.md has 888 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~133

When it runs · the whole SKILL.md, loaded when a task matches

~2.3k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NotePre-approves every shell command (allowed-tools: Bash)SKILL.md

  allowed-tools: Bash, Read, Write, Edit, Glob, Grep, Task, WebFetch, WebSearch, Skill

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from ljagiello/ctf-skills at commit c332c7b, republished under its MIT licence (© ljagiello). 888 words, ~2,293 tokens.

name

solve-challenge

description

Solves CTF challenges by performing first-pass triage, identifying the dominant category, and routing execution to the right specialized ctf-* skill. Use when the user gives you a challenge bundle, a remote service, a suspicious file, or only a vague challenge description and you must determine where to start. Do not use it when the category is already clear and a specialized skill can be invoked directly; this is the dispatcher and recon entrypoint, not the deepest reference for category-specific techniques.

allowed-tools

Bash, Read, Write, Edit, Glob, Grep, Task, WebFetch, WebSearch, Skill

compatibility

Requires filesystem-based agent (Claude Code or similar) with bash, Python 3, and internet access. Orchestrates other ctf-* skills.

license

MIT

metadata.user-invocable

true

metadata.argument-hint

[category] [challenge-file-or-url]

bash scripts/install_ctf_tools.sh all

bash scripts/install_ctf_tools.sh python
bash scripts/install_ctf_tools.sh apt
bash scripts/install_ctf_tools.sh brew
bash scripts/install_ctf_tools.sh gems
bash scripts/install_ctf_tools.sh go
bash scripts/install_ctf_tools.sh manual

# Detect CTFd (look for /api/v1/ and /themes/core/)
curl -s "$CTF_URL/api/v1/" | head -5
curl -s "$CTF_URL" | grep -oE '/themes/core/'

export CTF_URL="https://ctf.example.com"
export CTF_TOKEN="ctfd_..."  # Ask user for this

# Search for common flag patterns in files
grep -rniE '(flag|ctf|eno|htb|pico)\{' .
# Search in binary/memory output
strings output.bin | grep -iE '\{.*\}'

# Recon
file *                                    # Identify file types
strings binary | grep -i flag             # Quick string search
xxd binary | head -20                     # Hex dump header
binwalk -e firmware.bin                   # Extract embedded files
checksec --file=binary                    # Check binary protections

# Connect
nc host port                              # Connect to challenge
echo -e "answer1\nanswer2" | nc host port # Scripted input
curl -v http://host:port/                 # HTTP recon

# Python exploit template
python3 -c "
from pwn import *
r = remote('host', port)
r.interactive()
"

© ljagiello, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in solve-challenge of ljagiello/ctf-skills.

Open the folder on GitHubat commit c332c7b