Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

CTF 新手入口 — measured AI agent skill | DecimalAI

asdfgh1445/CTF•新手入口

NewSkillScoreMaintained

面向中文用户和新手的统一入口，保持原有两种模式：1) 自动分流，2) 先头脑风暴再分流。分流目标既可以是 ctf-*，也可以在 Web/接口/漏洞验证阶段增强到 strix-*；适合不知道该用哪个 skill、想先理清题意、又不想自己先判断何时该切到工具链或漏洞专项的场景;触发名:ctf-beginner-hub

agent-toolingby asdfgh1445

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/asdfgh1445-ctf/SKILL.md

decimalai skills pull asdfgh1445-ctf --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/asdfgh1445-ctf/SKILL.md https://app.decimal.ai/s/asdfgh1445-ctf/SKILL.md

Raw file: /s/asdfgh1445-ctf/SKILL.md ↗ · machine-readable summary at /s/asdfgh1445-ctf.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 2h ago

Yes — +61% lift · at higher cost+41% tokens0% turns78% of whole cases pass with skill (18/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	59%	0%
case-02	✗→✓	▲ Improved	49%	0%
case-04	✗→✓	▲ Improved	37%	0%
case-06	✗→✓	▲ Improved	51%	0%
case-07	✗→✓	▲ Improved	81%	0%

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

asdfgh1445 / ctf-super-hub

ctf-beginner-hub/SKILL.md

View on GitHub ↗

License NOASSERTIONImported 8/3/2026Version v1Bundled 4 files

Skill contents

references/

SKILL.md

CTF 新手入口

这是给 不会选 skill 的新手 用的统一入口。

它保持和你之前一样的两种模式，只是在需要时把 Strix 当成增强层接进去。

两种模式

模式 1：自动分流（默认推荐）

适合：

已经拿到题面、附件、URL、IP、端口、源码、二进制
不想自己判断分类

流程：

先判断更像哪一类题
再决定是走 ctf-* 还是增强到 strix-*
给你最小化下一步

模式 2：先头脑风暴，再分流

适合：

看不懂题面
不知道第一步做什么
想先理清目标、材料、卡点

流程：

先澄清题目到底给了什么
再判断走 ctf-* 还是增强到 strix-*
再给你最小化下一步

什么情况下还是走原来的 `ctf-*`

Reverse / Pwn / Crypto / Forensics / OSINT / Malware / Misc / AI/ML
还停留在 CTF 大类判断阶段
还没有进入具体 Web 测试动作阶段

什么情况下增强到 `strix-*`

当题目已经明显进入下面这些动作时：

要探测 URL / 状态码 / 标题 / 路由
要爬路径、跑字典、跑模板扫描
要验证 SQLi / XSS / SSRF / RCE / JWT / IDOR / 上传 / 文件包含

新手默认增强顺序

先用工具类

strix-httpx
strix-katana
strix-ffuf
strix-nuclei
strix-sqlmap

再用漏洞专项

strix-sql-injection
strix-xss
strix-ssrf
strix-rce
strix-authentication-jwt
strix-idor
strix-information-disclosure
strix-insecure-file-uploads
strix-open-redirect
strix-csrf
strix-business-logic
strix-broken-function-level-authorization
strix-path-traversal-lfi-rfi

新手友好输出规范

这题现在更像什么
为什么先走这个 skill
先做哪 1~3 步
每一步是在干什么
如果没结果，下一步切到哪个 skill
术语用一句人话解释

结束条件

当主 skill 被确定后：

进入对应 ctf-* 深挖
或增强到对应 strix-*
题做完后转 ctf-writeup

Want to see if asdfgh1445/CTF•新手入口 would activate on your phrasing? Try it before you install — no LLM call, no signup.

Other measured skills in the registry, with their headline benchmark lift.