analyze

Stars9

Forks1

UpdatedFebruary 22, 2026 at 02:02

Analyze CTF challenge files to detect category and suggest next steps. Use when starting a new challenge, receiving unknown files, or needing triage. Triggers: file, strings, xxd, binwalk output, unknown binaries, .bin .dat .raw .enc files, "what is this file", "analyze this", "identify challenge type". Routes to crypto/forensics/stego/web/pwn/ reverse/osint/misc skills based on detection.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Source

MysterionRise

MysterionRise/ctf-kit

View GitHub Repository View Creator Repositories

Download

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

File Explorer

4 files

SKILL.md

readonly

name	analyze
description	Analyze CTF challenge files to detect category and suggest next steps. Use when starting a new challenge, receiving unknown files, or needing triage. Triggers: file, strings, xxd, binwalk output, unknown binaries, .bin .dat .raw .enc files, "what is this file", "analyze this", "identify challenge type". Routes to crypto/forensics/stego/web/pwn/ reverse/osint/misc skills based on detection.

CTF Analyze

Analyze challenge files to determine type and suggest approaches.

When to Use

Use this command when you have new challenge files and need to:

Identify the challenge category (crypto, forensics, stego, web, pwn, reversing, OSINT, misc)
Detect file types and formats
Get initial suggestions for tools to use
Understand what you're working with

Bundled Scripts

check-tools.sh — Verify required analysis tools are installed
triage.sh — Multi-step triage pipeline: file type → strings → binwalk → category suggestion. Produces a JSON summary with detected category, confidence score, and recommended next skill.
run-strings.sh — Extract strings with pattern detection (flags, URLs, hashes, credentials). Outputs JSON with categorized findings.

Instructions

First check tool availability: bash scripts/check-tools.sh
Recommended: Run the full triage pipeline for automatic category detection:
```
bash scripts/triage.sh $ARGUMENTS
```
The triage script chains: file → strings → binwalk → exiftool, then outputs a JSON summary including:
- category: detected challenge type (crypto, forensics, stego, etc.)
- confidence: detection confidence (0-100%)
- suggested_skill: which /ctf-kit:* command to use next
- findings: flags, URLs, hashes, base64 strings found
- embedded_signatures: files hidden inside the challenge file
For strings-only analysis with pattern detection:
```
bash scripts/run-strings.sh $ARGUMENTS
```
Or run the CLI analysis:
```
ctf analyze $ARGUMENTS
```
Read the JSON output at the end of each script. It contains structured data you can use to decide next steps. The suggestions field tells you exactly what to do next.
Based on the triage results, use the recommended skill:
- /ctf-kit:crypto for cryptography challenges
- /ctf-kit:forensics for forensics challenges
- /ctf-kit:stego for steganography challenges
- /ctf-kit:web for web security challenges
- /ctf-kit:pwn for binary exploitation challenges
- /ctf-kit:reverse for reverse engineering challenges
- /ctf-kit:osint for OSINT challenges
- /ctf-kit:misc for miscellaneous challenges

Output Format

All scripts produce a === PARSED RESULTS (JSON) === section with structured data. Key fields:

Field	Description
`category`	Detected challenge category
`confidence`	Detection confidence (0.0-1.0)
`suggested_skill`	Which skill to invoke next
`findings.flags`	Any flags found in strings
`suggestions`	Actionable next steps

Example Usage

/ctf-kit:analyze challenge.bin
/ctf-kit:analyze ./challenge-folder/

Related Commands

/ctf-kit:crypto - Crypto-specific analysis
/ctf-kit:forensics - Forensics analysis
/ctf-kit:stego - Steganography analysis

More from this repository

same repository

compete

MysterionRise/ctf-kit

Manage a live CTF competition with an agent team. Auto-triages challenges, assigns them to teammates, and tracks progress. Use during live CTF competitions when you have multiple challenges to solve in parallel. Triggers: "competition mode", "live CTF", "start competition", "manage CTF", "assign challenges". Requires agent teams enabled.

2026-03-279

crypto

MysterionRise/ctf-kit

Solve CTF cryptography challenges including encryption, hashing, and encoding. Use when you see: Base64 (trailing ==), hex strings (32/40/64 chars for MD5/SHA1/SHA256), RSA parameters (n=, e=, c=, p=, q=), XOR-encrypted data, .pem .key .enc files, classical ciphers (Caesar, Vigenere, substitution), encoding chains, or "crack this hash". Tools: xortool, hashid, hashcat, john, RsaCtfTool, openssl.

2026-03-279

forensics

MysterionRise/ctf-kit

Solve CTF forensics challenges: memory dumps, network captures, disk images, and file carving. Use when you see: .vmem .raw .dmp memory dumps, .pcap .pcapng network captures, .dd .E01 disk images, or embedded/hidden files. Triggers: "memory dump", "packet capture", "disk image", "file carving", "deleted files", "volatility". Tools: volatility3, binwalk, foremost, tshark, sleuthkit. NOT for steganography (use stego) or binary exploitation (use pwn).

2026-03-279

misc

MysterionRise/ctf-kit

Solve CTF misc challenges: encoding chains, esoteric programming languages, QR codes, logic puzzles, and anything that doesn't fit crypto/forensics/stego/web/pwn/reverse/osint. Use when you see: Brainfuck (+[->), Ook!, Whitespace, JSFuck, QR/barcodes, multi-layer encoding (Base64->hex->ROT13), or "what encoding is this". Triggers: "decode this", "esoteric language", "QR code", "barcode", "encoding chain", "CyberChef", unusual character sets. Tools: CyberChef, zbarimg, dcode.fr, online interpreters.

2026-03-279

osint

MysterionRise/ctf-kit

Solve CTF OSINT (open source intelligence) challenges: username enumeration, domain recon, social media investigation, geolocation from images, and public records research. Use when given a username, email, domain, or photo to investigate. Triggers: "find this person", "username lookup", "who is", "geolocation", "reverse image search", "EXIF GPS", "whois", "domain recon", "social media". Tools: sherlock, theHarvester, exiftool, whois, dig. NOT for web app exploitation (use web).

2026-03-279

pwn

MysterionRise/ctf-kit

Solve CTF binary exploitation (pwn) challenges: buffer overflows, format strings, ROP chains, heap exploitation, and shellcoding. Use when given ELF/PE binaries with a remote service to exploit. Triggers: "buffer overflow", "format string", "ROP", "shellcode", "checksec", "NX", "canary", "PIE", "GOT overwrite", "ret2libc", pwntools scripts, .elf files, nc/netcat connection targets. Tools: checksec, ROPgadget, pwntools, gdb, one_gadget. NOT for static reverse engineering (use reverse).

2026-03-279

name	analyze
description	Analyze CTF challenge files to detect category and suggest next steps. Use when starting a new challenge, receiving unknown files, or needing triage. Triggers: file, strings, xxd, binwalk output, unknown binaries, .bin .dat .raw .enc files, "what is this file", "analyze this", "identify challenge type". Routes to crypto/forensics/stego/web/pwn/ reverse/osint/misc skills based on detection.

CTF Analyze

Analyze challenge files to determine type and suggest approaches.

When to Use

Use this command when you have new challenge files and need to:

Identify the challenge category (crypto, forensics, stego, web, pwn, reversing, OSINT, misc)
Detect file types and formats
Get initial suggestions for tools to use
Understand what you're working with

Bundled Scripts

check-tools.sh — Verify required analysis tools are installed
triage.sh — Multi-step triage pipeline: file type → strings → binwalk → category suggestion. Produces a JSON summary with detected category, confidence score, and recommended next skill.
run-strings.sh — Extract strings with pattern detection (flags, URLs, hashes, credentials). Outputs JSON with categorized findings.

Instructions

First check tool availability: bash scripts/check-tools.sh
Recommended: Run the full triage pipeline for automatic category detection:
```
bash scripts/triage.sh $ARGUMENTS
```
The triage script chains: file → strings → binwalk → exiftool, then outputs a JSON summary including:
- category: detected challenge type (crypto, forensics, stego, etc.)
- confidence: detection confidence (0-100%)
- suggested_skill: which /ctf-kit:* command to use next
- findings: flags, URLs, hashes, base64 strings found
- embedded_signatures: files hidden inside the challenge file
For strings-only analysis with pattern detection:
```
bash scripts/run-strings.sh $ARGUMENTS
```
Or run the CLI analysis:
```
ctf analyze $ARGUMENTS
```
Read the JSON output at the end of each script. It contains structured data you can use to decide next steps. The suggestions field tells you exactly what to do next.
Based on the triage results, use the recommended skill:
- /ctf-kit:crypto for cryptography challenges
- /ctf-kit:forensics for forensics challenges
- /ctf-kit:stego for steganography challenges
- /ctf-kit:web for web security challenges
- /ctf-kit:pwn for binary exploitation challenges
- /ctf-kit:reverse for reverse engineering challenges
- /ctf-kit:osint for OSINT challenges
- /ctf-kit:misc for miscellaneous challenges

Output Format

All scripts produce a === PARSED RESULTS (JSON) === section with structured data. Key fields:

Field	Description
`category`	Detected challenge category
`confidence`	Detection confidence (0.0-1.0)
`suggested_skill`	Which skill to invoke next
`findings.flags`	Any flags found in strings
`suggestions`	Actionable next steps

Example Usage

/ctf-kit:analyze challenge.bin
/ctf-kit:analyze ./challenge-folder/

Related Commands

/ctf-kit:crypto - Crypto-specific analysis
/ctf-kit:forensics - Forensics analysis
/ctf-kit:stego - Steganography analysis