reverse-skills-max: initial public release (restored, redacted, hardened)

reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-malware-config/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: competition-malware-config
+description: Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for malware configuration recovery, staged payload boundaries, beacon parameter extraction, and IOC decoding. Use when the user asks to recover a malware config, decode C2 or beacon fields, unpack staged payloads, extract bot or campaign IDs, or tie recovered config to observed protocol behavior under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
+---
+
+# Competition Malware Config
+
+Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
+
+Use this skill when the decisive value is not just "what the sample does," but which config fields, stages, or network parameters the sample hides and when they become plaintext.
+
+Reply in Simplified Chinese unless the user explicitly requests English.
+
+## Quick Start
+
+1. Preserve the original sample before unpacking or patching.
+2. Separate loader, payload, config blob, and post-decode behavior.
+3. Rank candidate config blobs by entropy, field shape, nearby strings, and decode helpers.
+4. Record the exact transform chain for each recovered field.
+5. Reproduce the decoded config or beacon parameters from the smallest possible path.
+
+## Workflow
+
+### 1. Find The Config Boundary
+
+- Inspect sections, resources, embedded archives, strings, imports, and decode helpers.
+- Identify where config is stored: resource, overlay, encrypted blob, registry seed, network bootstrap, or stage2 memory.
+- Keep one note of when each value becomes plaintext.
+
+### 2. Reconstruct The Decode Chain
+
+- Recover the chain in order: container -> compression -> encoding -> xor/substitution -> crypto -> parse.
+- Group all config fields from the same chain together instead of treating them as unrelated clues.
+- Preserve hashes, offsets, keys, IVs, masks, and parsed fields in one compact evidence block.
+
+### 3. Tie Config To Behavior
+
+- Show which field affects which branch: beacon path, mutex, wallet, bot id, campaign, tasking route, persistence name, or process target.
+- Correlate decoded config with PCAPs, process trees, or stage2 strings when possible.
+
+## Read This Reference
+
+- Load `references/malware-config.md` for the config-hunting checklist, staged-sample checklist, and evidence packaging rules.
+
+## What To Preserve
+
+- Original artifact, unpacked layer, dumped stage, and parsed config as separate artifacts
+- Offsets, hashes, decode helpers, keys, masks, and field names
+- The branch or protocol step each recovered field actually influences