How to use the CTF Crypto & Mobile Helper agent skill

What the skill makes the agent do

The skill is a specialist playbook for CTF-style challenges. It tells the agent to recover data in order rather than jumping to a complex algorithm: reconstruct the chain of container, compression, encoding, XOR or substitution, crypto, integrity check and final parse. For images and files it checks metadata, chunk layout, palettes, alpha planes, least significant bits, thumbnails and appended trailers. For mobile apps it starts with the manifest or plist, exported components, deeplinks, native libraries, shared preferences, local databases and configs, then traces signer logic and token storage.

• Crypto and encoding: rebuild the transform chain and keep exact keys, IVs, nonces, salts, tags, offsets and byte order.
• Steganography: rank decode attempts by evidence rather than brute-force guessing.
• Mobile: find the narrowest boundary (signer, crypto helper, keystore access, WebView bridge) that proves the behaviour, then reproduce the plaintext, payload or signed request.

Install the skill from the ZIP

Download the ZIP for this skill from this page and unzip it. The package contains agents/openai.yaml, references/crypto-mobile.md and SKILL.md. Place the unzipped folder in one of two locations: ~/.claude/skills/ for your user account, or .claude/skills/ inside a specific project.

Alternatively, in the Claude apps, open Settings, go to Capabilities, and upload the skill under Skills.

• Option A: unzip into ~/.claude/skills/ to make it available across your projects.
• Option B: unzip into .claude/skills/ inside one project folder.
• Option C: upload through Settings → Capabilities → Skills in the Claude apps.

Install the required parent skill first

This skill cannot run on its own. It is a downstream specialisation that expects $ctf-sandbox-orchestrator to be installed and already active. The parent skill establishes sandbox assumptions, node ownership and evidence priorities. If the parent has not run, the skill tells the agent to return to the orchestrator first.

The source files also reference companion skills $competition-android-hooking, $competition-ios-runtime and $competition-stego-media. These are not included in this package, so install them separately if you need Android hooking, iOS runtime tracing or media stego specialisation.

• Required: $ctf-sandbox-orchestrator, installed and active.
• Referenced but not included: $competition-android-hooking, $competition-ios-runtime, $competition-stego-media.
• Tooling for hooking and inspecting apps is implied but not specified in the files.

Trigger the skill with natural requests

Activate the parent orchestrator first, then describe the task in plain language. The skill is designed to match requests such as decoding a blob, recovering a transform chain or key, inspecting hidden media payloads, hooking an APK or IPA signer, inspecting app storage, or replaying mobile request-signing logic. You can also name the skill directly with $competition-crypto-mobile.

The agent replies in Simplified Chinese unless you explicitly ask for English, so say so in your request if you want English output.

• "With the orchestrator active, decode this base64 blob and recover the transform chain."
• "Find out whether the hidden payload in this PNG sits in the LSBs or in an appended trailer."
• "Inspect the shared preferences of this test APK and tell me where the signing key is stored."
• "Replay the request-signing logic of my own test IPA and reproduce the signed header."
• "Please answer in English: which Keychain items does this sandbox app use?"

Expected output and evidence

The skill asks the agent to keep an evidence record. It should preserve decisive bytes that prove each decode stage, hook points, signed strings, headers, local storage paths, component names, protobuf fields and trailer offsets. The source warns against reporting only algorithm names without a reproduced artifact.

• Reproduce the actual plaintext, payload, signed request or accepted branch.
• Keep exact parameters in one compact evidence block.
• Correlate static evidence with dynamic evidence before concluding.

Safety notes: scripts and network

The skill itself runs no scripts and uses no network access, according to its files. Its scope is still sensitive: it is aimed at competition sandboxes and does not establish legal scope. Only use it against challenges you are authorised to test, such as your own test APKs or IPAs and CTF environments. Do not point it at real apps, services or users without permission.

Any tools you run alongside the agent, such as app hooking or inspection tools, are not specified in the files, so review them yourself before use.

• Use only in an authorised sandbox or on your own test builds.
• The skill does not establish legal scope; you must confirm authorisation.
• It is not a production security audit tool or a compliance and reporting tool.