ctf-misc

76 / 100 · Review before installing

Check before installing. Some of what it can do is expected: a coding skill usually runs build and test commands.

By ljagiello/ctf-skills (GitHub) · coding · 3,679 stars · scanned at commit e79be29

Provides miscellaneous CTF challenge techniques for problems that do not cleanly fit the main categories. Use for encoding puzzles, pyjails, bash jails, RF/SDR, DNS oddities, unicode tricks, esoteric languages, QR or audio puzzles, constraint solving, game theory, unusual sandbox escapes, and hybrid logic puzzles. Prefer a more specific skill first when the challenge is mainly web, pwn, reverse, forensics, malware, OSINT, or crypto. Treat this as the fallback skill for genuine cross-category or…

Works with any agent that supports SKILL.md skills.

What this skill can do

Downloads and installs other software

This is disclosed by the author in the skill's SKILL.md or README.

Found in 9 places.

ctf-misc/SKILL.md, line 20pip install "pwntools==4.15.0" "segno==1.6.6" z3-solver Pillow numpy requests dnslib
ctf-misc/SKILL.md, line 25apt install libzbar0 qrencode ffmpeg
ctf-misc/SKILL.md, line 30brew install ffmpeg qrencode

Show 6 more

ctf-misc/SKILL.md, line 34- SageMath — Linux: `apt install sagemath`, macOS: `brew install --cask sage`
ctf-misc/audio.md, line 21pip install numpy
ctf-misc/audio.md, line 24apt install sox qsstv
ctf-misc/encodings-advanced.md, line 131**Key insight:** SMS PDU format: `0041000B91` prefix identifies SMS-SUBMIT. UDH field at bytes 29-40 contains `05000301XXYY` where XX=total parts, YY=sequence n
ctf-misc/encodings.md, line 496npm install -g base65536
ctf-misc/encodings.md, line 500pip install base65536

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README. Expected for a coding skill.

Found in 40 places.

ctf-misc/SKILL.md, line 20pip install "pwntools==4.15.0" "segno==1.6.6" z3-solver Pillow numpy requests dnslib
ctf-misc/SKILL.md, line 25apt install libzbar0 qrencode ffmpeg
ctf-misc/SKILL.md, line 30brew install ffmpeg qrencode

Show 17 more

ctf-misc/SKILL.md, line 66file mystery_file
ctf-misc/SKILL.md, line 97echo "encoded" | base64 -d
ctf-misc/SKILL.md, line 140file unknown_file
ctf-misc/SKILL.md, line 1487z x archive.7z # Universal
ctf-misc/SKILL.md, line 156while f=$(ls *.tar* *.gz *.bz2 *.xz *.zip *.7z 2>/dev/null|head -1) && [ -n "$f" ]; do
ctf-misc/SKILL.md, line 164zbarimg qrcode.png # Decode
ctf-misc/SKILL.md, line 178sox audio.wav -n spectrogram -o spec.png
ctf-misc/SKILL.md, line 267- **Lua sandbox escape:** Bypass `load()`/`os.execute()` filters via `os["execute"]` table indexing or `loadstring` alias. See [games-and-vms.md](games-and-vms.
ctf-misc/SKILL.md, line 301find / -perm -4000 2>/dev/null
ctf-misc/SKILL.md, line 316cat /etc/passwd # Check 5th colon-separated field
ctf-misc/SKILL.md, line 334id # Look for "docker" in groups
ctf-misc/SKILL.md, line 374export CTF_URL="https://ctf.example.com" CTF_TOKEN="ctfd_your_token_here"
ctf-misc/SKILL.md, line 386grep -rn "flag{" .
ctf-misc/SKILL.md, line 514`rvim` blocks `:!` but `:python3 import os; os.system("cmd")` executes arbitrary commands. Check `:version` for `+python3`/`+lua`/`+ruby`. See [games-and-vms-3.
ctf-misc/bashjails.md, line 282. Whether input is `eval`'d, passed to `bash -c`, or something else
ctf-misc/bashjails.md, line 91In a double-quoted eval context like `bash -c "\"${x}\""`:
ctf-misc/bashjails.md, line 98**Why it works:** The script wraps input in double quotes for `bash -c`, so `\$` becomes a literal `$`, then `$#` expands to `0`, giving the string `$0`. When e

and 20 more places

Connects to the internet

This is disclosed by the author in the skill's SKILL.md or README.

Found in 58 places.

ctf-misc/SKILL.md, line 371Detect CTFd (`curl -s "$CTF_URL/api/v1/" | head -5`) and interact via API. **Ask the user for their API token** (CTFd Settings > Access Tokens) — it is not prov
ctf-misc/SKILL.md, line 375curl -s -H "Authorization: Token $CTF_TOKEN" "$CTF_URL/api/v1/challenges" | jq -r '.data[] | "\(.id)\t\(.value)pts\t\(.category)\t\(.name)"'
ctf-misc/SKILL.md, line 376curl -s -X POST -H "Authorization: Token $CTF_TOKEN" -H "Content-Type: application/json" "$CTF_URL/api/v1/challenges/attempt" -d "{\"challenge_id\": $CID, \"sub

Show 17 more

ctf-misc/ctfd-navigation.md, line 29curl -sI "$CTF_URL" | grep -i 'ctfd\|powered-by'
ctf-misc/ctfd-navigation.md, line 32curl -s "$CTF_URL/api/v1/" | head -20
ctf-misc/ctfd-navigation.md, line 35curl -s "$CTF_URL" | grep -oE '(ctfd|CTFd|/themes/core)'
ctf-misc/ctfd-navigation.md, line 38curl -s "$CTF_URL/login" | grep -oE 'name="nonce"'
ctf-misc/ctfd-navigation.md, line 61curl -s -X POST "$CTF_URL/api/v1/tokens" \
ctf-misc/ctfd-navigation.md, line 74curl -s -H "Authorization: Token $CTF_TOKEN" "$CTF_URL/api/v1/users/me" | jq .
ctf-misc/ctfd-navigation.md, line 81NONCE=$(curl -sc cookies.txt "$CTF_URL/login" | grep 'name="nonce"' | grep -oE 'value="[^"]*"' | cut -d'"' -f2)
ctf-misc/ctfd-navigation.md, line 84curl -sb cookies.txt -c cookies.txt -X POST "$CTF_URL/login" \
ctf-misc/ctfd-navigation.md, line 89curl -s -b cookies.txt "$CTF_URL/api/v1/users/me" | jq .
ctf-misc/ctfd-navigation.md, line 100curl -s -H "Authorization: Token $CTF_TOKEN" "$CTF_URL/api/v1/challenges" | jq .
ctf-misc/ctfd-navigation.md, line 103curl -s -H "Authorization: Token $CTF_TOKEN" "$CTF_URL/api/v1/challenges?category=web" | jq .
ctf-misc/ctfd-navigation.md, line 106curl -s -H "Authorization: Token $CTF_TOKEN" "$CTF_URL/api/v1/challenges" | \
ctf-misc/ctfd-navigation.md, line 138curl -s -H "Authorization: Token $CTF_TOKEN" "$CTF_URL/api/v1/challenges/$CHALL_ID" | jq .
ctf-misc/ctfd-navigation.md, line 141curl -s -H "Authorization: Token $CTF_TOKEN" "$CTF_URL/api/v1/challenges/$CHALL_ID" | \
ctf-misc/ctfd-navigation.md, line 145curl -s -H "Authorization: Token $CTF_TOKEN" "$CTF_URL/api/v1/challenges/$CHALL_ID" | \
ctf-misc/ctfd-navigation.md, line 149curl -s -H "Authorization: Token $CTF_TOKEN" "$CTF_URL/api/v1/challenges/$CHALL_ID" | \
ctf-misc/ctfd-navigation.md, line 153curl -s -H "Authorization: Token $CTF_TOKEN" "$CTF_URL/api/v1/challenges/$CHALL_ID" | \

and 38 more places

Changes files outside its own folder

The author does not mention this.

Found in 3 places.

ctf-misc/linux-privesc.md, line 199echo 'chmod u+s /bin/bash' >> ~/server/bin/linux-x64/server-command
ctf-misc/linux-privesc.md, line 298mkdir -p ~/a/b
ctf-misc/linux-privesc.md, line 299ln -s /root/flag.txt ~/a/b/HackMe2.txt

Safer alternatives

Low-risk skills in the same category (coding) that look related. Check that one does what you need.

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'ctf-misc' ] || [ -L ~/.agents/skills/'ctf-misc' ]; then echo 'A skill folder named ctf-misc already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/ljagiello/ctf-skills' "$d" && git -C "$d" checkout --quiet 'e79be2925d1612e8a97070d6201e300286672370' -- 'ctf-misc' && mkdir -p ~/.agents/skills && cp -R "$d"/'ctf-misc' ~/.agents/skills/'ctf-misc' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'ctf-misc' ~/.claude/skills/'ctf-misc' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for ljagiello/ctf-skills shows the score of its lowest-scoring skill.

SkillTrust badge for ljagiello/ctf-skills

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/ljagiello/ctf-skills.svg)](https://zalavijaysinh.github.io/skilltrust/repos/ljagiello/ctf-skills/)

Score history

Date	Version	Score
2026-11-11	`e79be29`	76
2026-11-08	`2ad85d3`	76
2026-11-07	`2ad85d3`	66