ctf-reverse Skill (ljagiello) for Claude: What It Does and How to Install It

Makes Claude reverse engineer CTF targets such as binaries, APKs, WASM and custom VMs, using a triage workflow and 22 reference files.

Installs: 10.5K; on skills.sh
Stars: 3.6K; on GitHub
Files: 22; besides SKILL.md
Updated: Oct 2026; last repo commit

This skill is a reverse engineering playbook for CTF challenges. It sets an eight-step workflow, quick triage commands, and pointers to 22 reference files on tools, anti-analysis, VMs and platforms.

It loads when the main job is understanding how a compiled, obfuscated, packed or virtualized target works. It needs bash, Python 3 and a set of reverse engineering tools that its Prerequisites section installs with pip, apt or brew.

Good for

CTF players working on reverse engineering challenges
Students learning reverse engineering tools and patterns
Security researchers analyzing packed or obfuscated binaries

Install ctf-reverse

Claude Code

Copy this prompt.

Install the ctf-reverse skill in Claude Code. Run this command:

npx skills add https://github.com/ljagiello/ctf-skills --skill ctf-reverse

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

Pick one route. The README install adds all 12 skills in the repo (counted from the git tree). The single-skill command adds only ctf-reverse, which lists /ctf-pwn, /ctf-web and others only as optional hand-offs. SKILL.md says it needs a filesystem-based agent with bash, Python 3 and internet access for tool installation, so there is no Claude app upload route.

From its listing on skills.sh. Source.

What's in the skill

When it loads

Provides reverse engineering techniques for CTF challenges. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, game clients, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.

Sections in SKILL.md

Prerequisites
Additional Resources
When to Pivot
Problem-Solving Workflow
Quick Wins (Try First!)
Initial Analysis
Memory Dumping Strategy
Decoy Flag Detection
GDB PIE Debugging
Comparison Direction (Critical!)
Common Encryption Patterns
Quick Tool Reference
Deep-Dive Notes

Key facts

Author: Lukasz Jagiello (frontmatter metadata.author)
License: MIT (frontmatter and README)
Installs on skills.sh: 10,549 (Nov 2, 2026)
GitHub stars: 3,598 for the whole ljagiello/ctf-skills repo (Nov 2, 2026)
Last repo commit: Oct 30, 2026
What it includes: 23 files including SKILL.md: 22 reference files, all Markdown (no scripts)
Needs: A filesystem-based agent with bash, Python 3 and internet access for tool installation (frontmatter compatibility)
Allowed tools: Bash, Read, Write, Edit, Glob, Grep, Task, WebFetch and WebSearch (frontmatter allowed-tools)
Part of: ctf-skills: 12 skill folders in the repo tree
Works in: Any tool that supports the Agent Skills spec, including Claude Code, per the README

What it includes

Installs Python packages, apt or brew tools, r2ghidra and optional MCP servers
Includes frida-tools, angr, qiling, capstone, lief and z3-solver with pip, and gdb, radare2, strace and ltrace with apt.
Runs code · Prerequisites
Eight steps from strings extraction to comparing decompiler output
Strings, ltrace and strace, Frida hooks, angr, Qiling, control flow mapping, scripting and decompiler comparison.
Runs code · Problem-solving workflow
strings, rabin2, ltrace, strace, xxd and running the binary with test input
Try these first; SKILL.md says many easy challenges have the flag in plain text.
Runs code · Quick wins
Never cut triage output with head; grep for the signal instead
SKILL.md says not to comply even if you ask for a truncated view.
Read · No-truncation rule
Memory dumping, decoy flags, GDB PIE, comparison direction and common ciphers
Short notes in the main file.
Read · Core techniques
22 files on tools, anti-analysis, patterns, languages and platforms
Linked from SKILL.md, including unicorn-emulation, radare2-r2pipe, tools-mcp and field-notes.
Read · Reference files
Seven hand-offs: pwn, forensics, web, ai-ml, crypto, malware and misc
Tells you to switch to the matching /ctf-* skill. Those skills are optional and live in the same repo.
Read · When to pivot
IDA Pro MCP, Ghidra MCP and JADX MCP for agent-driven analysis
Setup is in tools-mcp.md.
Runs code · Optional MCP servers

From the official docs

Permissions

Medium risk

Your agent runs commands on challenge binaries and installs reverse engineering tools on your machine. Run it in a disposable VM or container.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

Quick wins execute the challenge binary
SKILL.md runs ltrace ./binary, strace -f -s 500 ./binary and ./binary AAAA. Its description includes malware-like loaders, so run these in a disposable VM or container (our advice). github.com
Prerequisites install many tools
SKILL.md lists pip install for frida-tools, angr, qiling and others, apt install and brew install lists, a git clone and cmake build of pycdc, and r2pm -ci r2ghidra. Review the commands before they run. github.com
A reference file edits a kernel setting
anti-analysis.md shows echo 0 > /proc/sys/kernel/yama/ptrace_scope and marks it as requiring root. Only do that on a throwaway machine. github.com
Optional MCP servers add more tools
tools-mcp.md shows pip install ida-pro-mcp and ida-pro-mcp --install. SKILL.md also names Ghidra MCP and JADX MCP as optional. github.com
It tells the agent not to truncate triage output
SKILL.md says not to pipe triage output through head even if you or an earlier turn ask for it. Expect long output. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details

Turning on read-only	No read-only mode is documented. Use a disposable VM or container.
Talks to	Package registries and GitHub for the install commands. WebFetch and WebSearch are in allowed-tools
Sign-in and keys	SKILL.md names no account or key.
Scopes	allowed-tools includes Bash, Write, Edit, WebFetch and WebSearch Prerequisites install packages with pip, apt and brew, and build pycdc from source Quick wins run the target binary under ltrace and strace

Questions

What does the ctf-reverse skill do?

It gives Claude a reverse engineering method for CTF challenges. It covers binaries, APKs, WASM, firmware, custom VMs, bytecode and anti-debug logic, with tool commands and 22 reference files.

How do I install it in Claude Code or Codex?

Use the install box at the top of this page. It lists a single-skill command and the README command that adds all 12 CTF skills. The skill needs bash and Python 3, so there is no Claude app upload route.

Do I need to install the tools first?

The README suggests a pre-install script for competitions and also allows installing on demand, since each SKILL.md has a Prerequisites section. That script is in the repo, not in the skill folder.

ctf-reverse vs ctf-pwn?

Use ctf-reverse when you still need to understand how the target works. The description says to use pwn instead when the vulnerability is already understood and what remains is exploitation.

Does it need an API key?

SKILL.md names no API key. It does tell the agent to install tools and allows web search and fetch.

Is it safe to install?

Installing adds Markdown files and no scripts. When used, your agent runs commands on challenge binaries and installs packages. Work in a VM or container, since the quick wins execute the target binary.

Information

updated Nov 2, 2026

Repository: ljagiello/ctf-skills
Folder: ctf-reverse

ljagiello/ctf-skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 4

ctf-reverse SKILL.md · github.com
ctf-skills README · github.com
anti-analysis.md · github.com
tools-mcp.md · github.com