ctf-box

84 / 100 · Low risk

Fine to try. Some of what it can do is expected: a coding skill usually runs build and test commands.

By Encod3d-Sec/TORCH (GitHub) · coding · 340 stars · scanned at commit d21b6c9

Boot-to-root methodology for a full machine (THM/HTB/PG/CTF box, "get user.txt+root.txt", "root the box", "foothold to root"). Enforces basic-tool recon (nmap, nc, ffuf, nuclei, dig) before anything custom, wiki-first lookups, and ALWAYS pspy + linpeas/winpeas for privesc. Use when handed a box/IP to own end-to-end.

Works with any agent that supports SKILL.md skills.

What this skill can do

Changes files outside its own folder

The author does not mention this.

Found in 1 place.

skills/workflow/ctf-box/SKILL.md, line 43**`vm.sh` drops long foreground commands (exit 255, no output) past ~2 min.** Run scans/cracks/sprays DETACHED (a tmux tab via `vm-scan.sh`, or `nohup <cmd> >/t

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README. Expected for a coding skill.

Found in 4 places.

skills/workflow/ctf-box/SKILL.md, line 48T=<ip>
skills/workflow/ctf-box/SKILL.md, line 95- **Diagnose target->attacker EGRESS before committing to a shell channel (recurring time-sink).** A connect-back that silently fails is usually a FILTERED egre
skills/workflow/ctf-box/SKILL.md, line 163./pspy64 -pf -i 1000 # see every exec + file event as root; reveals per-minute cron/systemd timers

Show 1 more

skills/workflow/ctf-box/SKILL.md, line 167./linpeas.sh # linux (winpeas.exe / winpeas.bat on windows)

Sends data to these websites: $t, t

This is disclosed by the author in the skill's SKILL.md or README.

Found in 3 places.

skills/workflow/ctf-box/SKILL.md, line 65whatweb -a3 http://$T ; curl -s -I http://$T # own tmux tab so it gets a recon card
skills/workflow/ctf-box/SKILL.md, line 76- **Capture it as-is first**: `capture.sh web <eng> <slug> http://T:PORT/` (browser shot) + `curl -s http://T:PORT/ > poc/<slug>-source.html` (raw source), for
skills/workflow/ctf-box/SKILL.md, line 80- **Read the client JS and snippet what it reveals.** Grep bundles for `fetch(`/`axios`/`/api`/`token`/`secret`/`admin`; a JS/SPA's POST-only JSON API is invisi

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'ctf-box' ] || [ -L ~/.agents/skills/'ctf-box' ]; then echo 'A skill folder named ctf-box already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/Encod3d-Sec/TORCH' "$d" && git -C "$d" checkout --quiet 'd21b6c94982cec09c88ae9c0e98f4e3865de7148' -- 'skills/workflow/ctf-box' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/workflow/ctf-box' ~/.agents/skills/'ctf-box' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'ctf-box' ~/.claude/skills/'ctf-box' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for Encod3d-Sec/TORCH shows the score of its lowest-scoring skill.

SkillTrust badge for Encod3d-Sec/TORCH

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/Encod3d-Sec/TORCH.svg)](https://zalavijaysinh.github.io/skilltrust/repos/Encod3d-Sec/TORCH/)

Score history

Date	Version	Score
2026-11-07	`d21b6c9`	100