菜单
Run Agent Smith in CTF mode for Capture The Flag challenges. Use when doing CTF, finding flags, hunting exploitable vulnerabilities, or analyzing challenge code for quick wins.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Add new static analysis rules to Agent Smith's rule engine. Use when creating detection rules, adding regex patterns for vulnerabilities, or extending the static scanner.
Interpret and triage Agent Smith scan findings. Use when reading scan results, understanding severity ratings, or deciding what to fix first.
Start, configure, and use the Agent Smith MCP server from Cursor. Use when setting up the MCP server, running scans via MCP tools, or integrating Agent Smith into Cursor IDE workflows.
Choose and combine AI analysis profiles for Agent Smith scans. Use when selecting profiles, combining multiple profiles, or understanding which profile fits a target codebase.
Run Agent Smith security scans with the right mode, preset, and flags. Use when scanning code for vulnerabilities, running security audits, or when the user mentions agentsmith, security scan, or vulnerability analysis.
| name | agentsmith-ctf |
| description | Run Agent Smith in CTF mode for Capture The Flag challenges. Use when doing CTF, finding flags, hunting exploitable vulnerabilities, or analyzing challenge code for quick wins. |
User is working on a CTF challenge and needs to find vulnerabilities fast.
# Fast recon (8 files, ~2 min, ~$0.03)
python3 agentsmith.py hybrid ./challenge ./scanner --preset ctf-fast
# Full CTF analysis with attack chains (15 files, ~5 min, ~$0.10)
python3 agentsmith.py hybrid ./challenge ./scanner --preset ctf --show-chains
# Targeted hunt
python3 agentsmith.py hybrid ./challenge ./scanner --preset ctf \
--question "find SQL injection and command injection" \
--show-chains --generate-payloads --top 5
| Preset | Files | Payloads | Chains | Use when |
|---|---|---|---|---|
ctf-fast | 8 | No | No | First look, time pressure |
ctf | 15 | Yes | Yes | Full analysis, want exploits |
--show-chains)Traces data flow from user input to dangerous sinks across files. Shows the complete exploitation path, not just individual findings.
--generate-payloads)Generates working exploit payloads for top findings. Includes: injection strings, bypass techniques, flag extraction commands.
Direct the AI at specific vulnerability classes:
--question "find deserialization vulnerabilities"
--question "find SSTI and template injection"
--question "find authentication bypass"
--question "find file upload vulnerabilities"
--question "find command injection in user input handlers"
--preset ctf-fast to get a quick overview--preset ctf --question "focus area" --show-chains --generate-payloadsmcp> scan_hybrid preset=ctf-fast
mcp> summary
mcp> findings 10
mcp> scan_hybrid preset=ctf question="find the flag" generate_payloads=true
mcp> payloads
Use ctf subcommand for standalone AI analysis (no static scanner):
python3 agentsmith.py ctf ./challenge "find all vulnerabilities and flags" \
--top-n 10 --generate-payloads
Use hybrid --preset ctf for static + AI combined (more thorough):
python3 agentsmith.py hybrid ./challenge ./scanner --preset ctf --show-chains
Hybrid is better when you have time. CTF subcommand is faster when you don't.