How do I install the Ctf Sandbox Orchestrator skill?

Run npx skillmds@latest add netvar1337/ctf-sandbox-orchestrator in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Ctf Sandbox Orchestrator safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Ctf Sandbox Orchestrator?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Ctf Sandbox Orchestrator free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Ctf Sandbox Orchestrator?

netvar1337 (@netvar1337) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Ctf Sandbox Orchestrator by netvar1337

Name: Ctf Sandbox Orchestrator
Author: netvar1337

Ctf Sandbox Orchestrator

Sidecar orchestrator for CTF / AWD / cyber range / sandbox multi-surface engagements. Takes over after the ctf-sandbox PRIMARY routes in: sets up the lab network profile, initializes the case with auth.status=granted, and dispatches each challenge to its specialist (pwn-chain, apk-reverse, ida-reverse/r2mcp-basic, api-security/pentest-tools) without inventing new workflows. Use when a CTF/cyber range task needs multi-challenge orchestration, case init, network profile scoping, or downstream routing decisions.

netvar1337 Updated Sep 17, 2026

File contents

CTF Sandbox Orchestrator (sidecar)

This is the operational sidecar that ctf-sandbox hands off to. It is NOT a second router and it does NOT duplicate the 40+ competition-* playbooks. It sets up the lab and dispatches each challenge to the specialist that owns it.

Entry contract

ctf-sandbox is the thin PRIMARY. When it fires, it calls this orchestrator with the intent "orchestrate this CTF/cyber range session." Your job, in order:

Case init. Run ../scripts/case-init.ps1 with auth.status=granted so the session is a scoped, granted case. Never skip case init on a multi-challenge task.
Network profile. Set the sandbox -NetworkProfile lab (or offline when no egress is allowed). Scoping here prevents a challenge from poking outside the lab.
Route, don't solve. For each challenge, name the owning specialist and hand off:
- pwn / ROP / kernel pwn → pwn-chain
- APK / Android → apk-reverse
- IDA / deep binary → ida-reverse or r2mcp-basic / radare2
- web / API → api-security or pentest-tools Do not re-invent the workflow a specialist already defines. Your value is sequencing and scoping, not re-deriving methodology.
MUST NOT enumerate the 40+ competition-* playbooks into the prompt. Use routing.json if it exists; otherwise pick the specialist by challenge type.

Scope guard

CTF-Sandbox-Orchestrator/ is a GPL-licensed third-party sidecar. Treat it as an external checkout, not as canon you rewrite. Canon skills are MIT + scope.md.
Never run a challenge against a live third-party network; the lab profile is the boundary. -NetworkProfile lab and offline are the default states.

Verification gate

Case init ran and reported auth.status=granted
Network profile applied (lab/offline) before any challenge
Every challenge mapped to exactly one specialist PRIMARY
No competition-* enumeration occurred in the handoff
Each challenge's completion is checked by its specialist's verification gate

Pair with

ctf-sandbox — thin entry that routes here
attack-chain — when the sandbox is multi-node and the task is a path, not a single pwn
case-review — when packaging the completed CTF case for a report

---name: ctf-sandbox-orchestratordescription: Sidecar orchestrator for CTF / AWD / cyber range / sandbox multi-surface engagements. Takes over after the ctf-sandbox PRIMARY routes in: sets up the lab network profile, initializes the case with auth.status=granted, and dispatches each challenge to its specialist (pwn-chain, apk-reverse, ida-reverse/r2mcp-basic, api-security/pentest-tools) without inventing new workflows. Use when a CTF/cyber range task needs multi-challenge orchestration, case init, network profile scoping, or downstream routing decisions.---# CTF Sandbox Orchestrator (sidecar)This is the operational sidecar that `ctf-sandbox` hands off to. It is NOT a secondrouter and it does NOT duplicate the 40+ `competition-*` playbooks. It sets up thelab and dispatches each challenge to the specialist that owns it.## Entry contract`ctf-sandbox` is the thin PRIMARY. When it fires, it calls this orchestrator with theintent "orchestrate this CTF/cyber range session." Your job, in order:1. **Case init.** Run `../scripts/case-init.ps1` with `auth.status=granted` so the session is a scoped, granted case. Never skip case init on a multi-challenge task.2. **Network profile.** Set the sandbox `-NetworkProfile lab` (or `offline` when no egress is allowed). Scoping here prevents a challenge from poking outside the lab.3. **Route, don't solve.** For each challenge, name the owning specialist and hand off: - pwn / ROP / kernel pwn → `pwn-chain` - APK / Android → `apk-reverse` - IDA / deep binary → `ida-reverse` or `r2mcp-basic` / `radare2` - web / API → `api-security` or `pentest-tools` Do not re-invent the workflow a specialist already defines. Your value is sequencing and scoping, not re-deriving methodology.4. **MUST NOT** enumerate the 40+ `competition-*` playbooks into the prompt. Use `routing.json` if it exists; otherwise pick the specialist by challenge type.## Scope guard- `CTF-Sandbox-Orchestrator/` is a GPL-licensed third-party sidecar. Treat it as an external checkout, not as canon you rewrite. Canon skills are MIT + `scope.md`.- Never run a challenge against a live third-party network; the lab profile is the boundary. `-NetworkProfile lab` and `offline` are the default states.## Verification gate- [ ] Case init ran and reported `auth.status=granted`- [ ] Network profile applied (lab/offline) before any challenge- [ ] Every challenge mapped to exactly one specialist PRIMARY- [ ] No `competition-*` enumeration occurred in the handoff- [ ] Each challenge's completion is checked by its specialist's verification gate## Pair with- `ctf-sandbox` — thin entry that routes here- `attack-chain` — when the sandbox is multi-node and the task is a path, not a single pwn- `case-review` — when packaging the completed CTF case for a report

Frequently asked questions