CTF•恶意软件分析

84 / 100 · Low risk

Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By asdfgh1445/ctf-super-hub (GitHub) · security · 847 stars · scanned at commit 7715719

用于混淆脚本、恶意样本、自定义加密协议、C2 流量、PE/.NET 二进制、RC4/AES 通信、YARA、shellcode、进程注入与反分析等恶意软件类 CTF 题;触发名:ctf-malware

Works with any agent that supports SKILL.md skills.

What this skill can do

Downloads and installs other software

This is disclosed by the author in the skill's SKILL.md or README.

Found in 3 places.

ctf-malware/SKILL.md, line 19pip install yara-python pefile capstone oletools unicorn pycryptodome \
ctf-malware/SKILL.md, line 25apt install strace ltrace tshark binwalk binutils
ctf-malware/SKILL.md, line 30brew install wireshark binwalk binutils ghidra

Runs commands on your computer

The author does not mention this. Expected for a security skill.

Found in 12 places.

ctf-malware/SKILL.md, line 19pip install yara-python pefile capstone oletools unicorn pycryptodome \
ctf-malware/SKILL.md, line 25apt install strace ltrace tshark binwalk binutils
ctf-malware/SKILL.md, line 30brew install wireshark binwalk binutils ghidra

Show 9 more

ctf-malware/SKILL.md, line 54file suspicious_file
ctf-malware/SKILL.md, line 90tshark -r file.pcap -Y "tcp.stream eq X" -T fields -e tcp.payload
ctf-malware/SKILL.md, line 119peframe malware.exe # Quick triage
ctf-malware/SKILL.md, line 157ar -x package.deb && tar -xf control.tar.xz # Check postinst scripts
ctf-malware/SKILL.md, line 177strings malware | grep -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
ctf-malware/scripts-and-obfuscation.md, line 128tcpdump = subprocess.Popen(
ctf-malware/scripts-and-obfuscation.md, line 130stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
ctf-malware/scripts-and-obfuscation.md, line 134result = subprocess.run(
ctf-malware/scripts-and-obfuscation.md, line 139except subprocess.TimeoutExpired:

Sends data to these websites: api.telegram.org, {domain}

This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.

Found in 4 places.

ctf-malware/c2-and-protocols.md, line 135r = requests.get(f"https://api.telegram.org/bot{TOKEN}/getUpdates")
ctf-malware/c2-and-protocols.md, line 138r = requests.get(f"https://api.telegram.org/bot{TOKEN}/getFile?file_id={file_id}")
ctf-malware/c2-and-protocols.md, line 140requests.get(f"https://api.telegram.org/file/bot{TOKEN}/{file_path}")

Show 1 more

ctf-malware/scripts-and-obfuscation.md, line 446flag = requests.get(f"http://{domain}/{path}", cookies={"uuid": uuid}).text

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'ctf' ] || [ -L ~/.agents/skills/'ctf' ]; then echo 'A skill folder named ctf already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/asdfgh1445/ctf-super-hub' "$d" && git -C "$d" checkout --quiet '7715719738578b36b0a84b74aeb0de41bda0eaae' -- 'ctf-malware' && mkdir -p ~/.agents/skills && cp -R "$d"/'ctf-malware' ~/.agents/skills/'ctf' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'ctf' ~/.claude/skills/'ctf' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for asdfgh1445/ctf-super-hub shows the score of its lowest-scoring skill.

SkillTrust badge for asdfgh1445/ctf-super-hub

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/asdfgh1445/ctf-super-hub.svg)](https://zalavijaysinh.github.io/skilltrust/repos/asdfgh1445/ctf-super-hub/)

Score history

Date	Version	Score
2026-11-08	`7715719`	84
2026-11-07	`7715719`	84