How to use the Competition Firmware Layout agent skill

What is an agent skill?

An agent skill is a folder containing a SKILL.md file and optional reference files that tell an AI agent how to handle a specific kind of task. When the request matches the skill's description, the agent loads the instructions and follows its workflow.

This skill is an internal downstream add-on. It is designed to run only after a separate orchestrator skill, ctf-sandbox-orchestrator, has set the sandbox assumptions and routed the work here.

What the skill makes the agent do

The skill asks the agent to work in a fixed order rather than jumping to the most interesting file. It starts by preserving the original image, extracted partitions, unpacked filesystems and any patched copies as separate artifacts, then maps the outer container, partition table, bootloader, kernel, rootfs, config and update metadata before any editing happens.

After mapping the layout, the agent tracks the boot or update chain stage by stage and notes which credentials, certificates, seeds or config files each stage consumes. It finishes by reducing the findings to the shortest chain from the image boundary to the decisive result, such as a service exposure, auth bypass, debug interface, recovered credential or flag artifact.

• Record offsets, sizes, hashes, mount points and partition names before extraction changes anything.
• Separate bootloader, kernel, initramfs, rootfs, config blobs and update metadata as distinct layers.
• Follow the chain: bootloader to kernel to init to services, or update package to verifier to installer.
• Keep extracted filesystems and patch experiments apart from pristine inputs.
• Switch to the broader reverse skill if the work becomes mostly native crash behaviour or exploit development.

Install the skill from the ZIP

Download the ZIP for this skill from this page. Unzip it into your personal skills folder, ~/.claude/skills/, or into a project's .claude/skills/ folder if you want the skill available only within that project.

Alternatively, upload the skill in the Claude apps under Settings → Capabilities → Skills.

Install the companion ctf-sandbox-orchestrator skill as well. This skill should not be used without it.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills (upload)

Trigger the skill with natural requests

You do not need a special command. The skill's description lists the kinds of request that should load it, so describe what you need in plain language. The orchestrator must already be active and have established the sandbox assumptions, so start the session with that skill first.

The description names these triggers: unpacking firmware, mapping partition layout, inspecting bootloader or init chains, recovering update keys or credentials, tracing config loading, and explaining how a device surface reaches the decisive artifact.

• Unpack this firmware image and tell me the partition layout.
• Map the partitions and offsets in this image before we change anything.
• Trace how the bootloader hands off to the kernel and init in this firmware.
• Find where the config file for the web service is loaded during boot.
• Explain how the update package is verified and which key it uses.
• Show how the device's exposed service reaches the flag artifact.

What you need before you start

The skill itself does not name the firmware extraction or inspection tools it expects. The files say these are implied, so you will need to provide a working environment for unpacking and inspecting firmware yourself.

The skill is for authorised work in a lab sandbox or CTF exercise. It is not for analysing real, production or third-party devices without authorisation, because its focus is recovering keys, credentials and auth bypasses.

• The ctf-sandbox-orchestrator companion skill installed and active.
• Firmware extraction and inspection tools available in your environment (not named in the skill files).
• A CTF or lab image you are authorised to analyse.

Safety notes: scripts and network

This skill runs no scripts and uses no network access, according to the skill's own assessment. The agent works from the files you give it and the instructions in SKILL.md and references/firmware-layout.md.

Because the skill targets key and credential recovery and auth bypass, keep work inside an authorised sandbox and keep original images separate from any patched copies, as the skill itself recommends.

• Runs scripts: no
• Uses network: no
• Keep pristine images, extracted layers and patched copies as separate files.

Tips for better results

Give the agent the image and say which stage you care about, such as the bootloader, the update verifier or a specific service. Narrow questions produce shorter, more useful evidence chains.

Ask the agent to record offsets and hashes first. The skill's checklist warns against editing extracted files before pristine offsets and hashes are recorded, and against mixing config from one partition with behaviour from another without proving the link.

The skill replies in Simplified Chinese unless you explicitly ask for English, so state your language preference in the request.

• Name the stage you want to analyse (bootloader, kernel, init, update verifier).
• Ask for the evidence chain with offsets, hashes and partition names.
• Specify English in your request if you do not want Simplified Chinese replies.