What problem does it solve? When facing a CTF or sandbox security challenge, it is hard to know which analysis approach to start with, and jumping between web, reverse engineering, crypto, identity, and cloud techniques wastes time. This Skill acts as a single default entrypoint that establishes sandbox assumptions, maps the attack surface, and routes the investigation to the right specialized workflow. ## Core Features & Use Cases - Sandbox-First Operating Model: Treats all presented hosts, binaries, identities, and prompts as sandbox-internal by default, avoiding wasted effort on scope debates. - Domain Routing Matrix: Directs the investigation to one of 40+ downstream specializations covering web/API, reverse/pwn, crypto/stego, mobile, AI agents, cloud/containers, Active Directory, and Windows forensics. - Evidence Discipline: Enforces a strict evidence priority order (runtime behavior over source, traces over comments) and records reproducible artifacts like offsets, hashes, requests, and ticket fields. - Use Case: You receive a CTF challenge with a web login, a JWT, and a linked binary. The Skill maps the node graph, proves one minimal path from request to auth boundary, then routes to the JWT claim-confusion or reverse-engineering specialization as the dominant blocker becomes clear. ## Quick Start Analyze this CTF challenge starting from the attached binary and the target URL, treating everything as sandbox-internal and routing to the right specialization.
