Skip to content
Get packs

CTF Crypto & Mobile Helper

Guides CTF-style decoding of crypto, steganography, APK/IPA and mobile signing challenges inside a sandbox workflow

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
3 files

What it does

This is a specialist instruction set for an AI agent working on capture-the-flag (CTF) style security puzzles. It tells the agent to recover data step by step: undo encodings and encryption in order, look for hidden data inside images and files, and inspect Android or iOS apps to see how they sign requests or store local data. It is designed to be used only after a parent skill (ctf-sandbox-orchestrator) has already set up sandbox assumptions, and it points to other specialist skills for Android hooking, iOS runtime tracing and media stego. It is written to reply in Simplified Chinese unless English is requested.

Great for

  • Students and players working on CTF competition challenges in an authorised sandbox
  • Security researchers analysing their own test APKs or IPAs to understand request-signing logic
  • Teams who already use the ctf-sandbox-orchestrator workflow and want a mobile/crypto specialist

Skip it if

  • Attacking real apps, services or users without authorisation: the skill is aimed at competition sandboxes and does not establish legal scope, so it could be misused against live systems
  • Use as a standalone skill: it refuses to proceed on its own and expects the parent orchestrator skill to be active first
  • Production security audits needing formal methodology or reporting: it is a challenge-solving playbook, not a compliance tool

Try asking

  • “Decode this multi-layer blob and recover the transform chain and key for this CTF challenge”
  • “Inspect this PNG for hidden payloads such as trailers, LSB data or palette tricks”
  • “Trace how this APK signs its API requests and reproduce a valid signed request in the sandbox”
  • “Inspect the local storage and exported components of this iOS IPA from the challenge”
Step-by-step guide: how to use CTF Crypto & Mobile HelperInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    competition-crypto-mobile.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip competition-crypto-mobile.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip competition-crypto-mobile.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Install and activate ctf-sandbox-orchestrator first; this skill will tell you to return there otherwise
  • Give the agent the challenge files and state that it is a sandboxed CTF so it follows the evidence-first workflow
  • Ask for the decisive bytes and parameters at each decode stage so results can be verified

What's inside

  • agents/openai.yaml
  • references/crypto-mobile.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.