reverse-skills-max: initial public release (restored, redacted, hardened)

reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-malware-config/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: competition-malware-config
+description: Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for malware configuration recovery, staged payload boundaries, beacon parameter extraction, and IOC decoding. Use when the user asks to recover a malware config, decode C2 or beacon fields, unpack staged payloads, extract bot or campaign IDs, or tie recovered config to observed protocol behavior under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
+---
+
+# Competition Malware Config
+
+Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
+
+Use this skill when the decisive value is not just "what the sample does," but which config fields, stages, or network parameters the sample hides and when they become plaintext.
+
+Reply in Simplified Chinese unless the user explicitly requests English.
+
+## Quick Start
+
+1. Preserve the original sample before unpacking or patching.
+2. Separate loader, payload, config blob, and post-decode behavior.
+3. Rank candidate config blobs by entropy, field shape, nearby strings, and decode helpers.
+4. Record the exact transform chain for each recovered field.
+5. Reproduce the decoded config or beacon parameters from the smallest possible path.
+
+## Workflow
+
+### 1. Find The Config Boundary
+
+- Inspect sections, resources, embedded archives, strings, imports, and decode helpers.
+- Identify where config is stored: resource, overlay, encrypted blob, registry seed, network bootstrap, or stage2 memory.
+- Keep one note of when each value becomes plaintext.
+
+### 2. Reconstruct The Decode Chain
+
+- Recover the chain in order: container -> compression -> encoding -> xor/substitution -> crypto -> parse.
+- Group all config fields from the same chain together instead of treating them as unrelated clues.
+- Preserve hashes, offsets, keys, IVs, masks, and parsed fields in one compact evidence block.
+
+### 3. Tie Config To Behavior
+
+- Show which field affects which branch: beacon path, mutex, wallet, bot id, campaign, tasking route, persistence name, or process target.
+- Correlate decoded config with PCAPs, process trees, or stage2 strings when possible.
+
+## Read This Reference
+
+- Load `references/malware-config.md` for the config-hunting checklist, staged-sample checklist, and evidence packaging rules.
+
+## What To Preserve
+
+- Original artifact, unpacked layer, dumped stage, and parsed config as separate artifacts
+- Offsets, hashes, decode helpers, keys, masks, and field names
+- The branch or protocol step each recovered field actually influences

reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-malware-config/agents/openai.yaml

@@ -0,0 +1,7 @@
+interface:
+  display_name: "Competition Malware Config"
+  short_description: "Recover staged configs, beacon fields, and plaintext boundaries"
+  default_prompt: "After $ctf-sandbox-orchestrator is active, use $competition-malware-config to recover the hidden config, staging layers, bot IDs, or beacon parameters from this sample."
+
+policy:
+  allow_implicit_invocation: false

reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-malware-config/references/malware-config.md

@@ -0,0 +1,36 @@
+# Malware Config And Staging Checklist
+
+## Hunt For The Config Boundary
+
+- Resources, overlays, embedded archives, section anomalies, decode helpers, registry seeds, bootstrap responses, stage2 memory
+- Nearby markers: URLs, mutex seeds, wallet-like strings, campaign IDs, bot IDs, task routes, persistence names
+
+## Reconstruct The Transform Chain
+
+Track in order:
+
+1. Container or embedded layer
+2. Compression or chunking
+3. Encoding or substitution
+4. XOR or custom masks
+5. Crypto
+6. Final parse into fields
+
+## Tie Fields To Behavior
+
+- Beacon path or host -> network flow
+- Mutex or install path -> persistence branch
+- Campaign or bot id -> server-side routing or tasking
+- Wallet or key material -> downstream protocol or decryption branch
+
+## Evidence To Keep
+
+- One compact block for offsets, hashes, decode helpers, keys, masks
+- One compact block for parsed fields and what branch each field affects
+- Original, unpacked, dumped, and parsed outputs kept as separate artifacts
+
+## Common Pitfalls
+
+- Treating one IOC-looking string as the config without proving the full chain
+- Mixing fields from separate decode paths as if they came from one blob
+- Forgetting to prove where config becomes plaintext