Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/asaotomo/deepsentry/ctfnpx skills add asaotomo/DeepSentry --skill ctfgit clone --depth 1 https://github.com/asaotomo/DeepSentryWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/asaotomo/deepsentry/ctf)<a href="https://agentmods.dev/skills/asaotomo/deepsentry/ctf"><img src="https://agentmods.dev/badge/skills/asaotomo/deepsentry/ctf.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00033 | $0.00544 |
| Opus 5 | $0.00016 | $0.00272 |
| Sonnet 5 | $0.00007 | $0.00109 |
| Haiku 4.5 | $0.00003 | $0.00054 |
Grade A, and why
ctf scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
CTF Skill
何时使用
- 用户明确提到 CTF、flag、题目附件、Web 题、Misc、取证、日志分析。
- 需要在授权靶场或本地题目环境中查找 flag 或解释解题路径。
工作流
- 明确题型、输入材料和授权范围；不要扫描第三方公网目标。
- Web 题优先使用
headless_browser获取渲染后 DOM、表单、链接和文本；失败时接受静态回退。 - 加密 ZIP 先
load_skill zipcracker，再用zip_password_recover：action=auto会按 ZipCracker 顺序先修伪加密，再对 1～6 字节条目做 CRC32 内容恢复，最后用内置 6000 字典。不要把 CRC32 命中的明文当成密码。已知明文/bkcrack尚未复刻。 - 文件/目录题优先
glob、grep、file_ident、file_strings、flag_scan。 - 日志/取证题优先
read_log、read_gzip、log-analyst子 Agent。 - 每个结论必须绑定证据：路径、URL、匹配片段、响应状态或日志时间。
推荐工具
{"action":"tool","tool_name":"tool_catalog","tool_args":{"category":"Web探测","query":"headless"}}
{"action":"tool","tool_name":"headless_browser","tool_args":{"url":"http://127.0.0.1:8080","mode":"snapshot","wait_ms":"1500"}}
{"action":"tool","tool_name":"flag_scan","tool_args":{"root":".","limit":"80"}}
输出格式
## CTF 分析结果
### 题型判断
### 关键证据
### 已尝试路径
### Flag / 当前最佳结论
### 下一步
边界
- 不自动爆破真实账号，不做未授权公网攻击。
- 需要写脚本时先说明脚本目的、输入、输出和读写边界，再用
script_run请求确认。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +1 lines 2a626e1e0606
- 4d ago First seen · 45 lines · 33 tokens per session scan A 2e817cde9647
ctf is a skill published in the GitHub repository asaotomo/DeepSentry (24 stars, last pushed today), licensed Apache-2.0. It adds 33 tokens to every session and 544 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
go-expert
Expert-level Go development with Go 1.22+ features, concurrency, standard library, and production-grade best practices.
skill-creator
Create, install, or update skills in the workspace. Use when (1) installing a skill from a URL or remote source, (2) creating a new skill from scratch, (3) updating or restructuring existing skills. Always use this skill for any skill installation or creation task.
image-generation
Generate or edit images from text prompts. Use when the user asks to create, draw, design, or edit an image, illustration, photo, icon, poster, or any visual content.
release-notes
Draft concise release notes.
smart-docs
AI-powered comprehensive codebase documentation generator. Analyzes project structure, identifies architecture patterns, creates C4 model diagrams, and generates professional technical documentation. Use when users need to document codebases, understand software architecture, create technical specs, or generate…
litho-document-skill
This skill should be used when the user asks to "generate project documentation", "analyze codebase architecture", "create C4 architecture diagrams", "document a repository", "generate technical docs", "使用 Litho 生成文档", "分析代码库架构", "生成架构文档", "为项目生成技术文档", "生成 C4 模型文档", "为这个项目写文档", "自动生成文档", "帮我分析这个代码库", or any request…