Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add asaotomo/DeepSentry --skill ctfgit clone --depth 1 https://github.com/asaotomo/DeepSentryWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/asaotomo/deepsentry/ctf)<a href="https://agentmods.dev/skills/asaotomo/deepsentry/ctf"><img src="https://agentmods.dev/badge/skills/asaotomo/deepsentry/ctf/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/asaotomo/deepsentry/ctf"><img src="https://agentmods.dev/badge/skills/asaotomo/deepsentry/ctf.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.00544 |
| Opus 5.5 | $0.00013 | $0.00218 |
| Sonnet 5.5 | $0.00007 | $0.00109 |
| Haiku 4.5 | $0.00003 | $0.00054 |
Grade A, and why
ctf scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
CTF Skill
何时使用
- 用户明确提到 CTF、flag、题目附件、Web 题、Misc、取证、日志分析。
- 需要在授权靶场或本地题目环境中查找 flag 或解释解题路径。
工作流
- 明确题型、输入材料和授权范围；不要扫描第三方公网目标。
- Web 题优先使用
headless_browser获取渲染后 DOM、表单、链接和文本；失败时接受静态回退。 - 加密 ZIP 先
load_skill zipcracker，再用zip_password_recover：action=auto会按 ZipCracker 顺序先修伪加密，再对 1～6 字节条目做 CRC32 内容恢复，最后用内置 6000 字典。不要把 CRC32 命中的明文当成密码。已知明文/bkcrack尚未复刻。 - 文件/目录题优先
glob、grep、file_ident、file_strings、flag_scan。 - 日志/取证题优先
read_log、read_gzip、log-analyst子 Agent。 - 每个结论必须绑定证据：路径、URL、匹配片段、响应状态或日志时间。
推荐工具
{"action":"tool","tool_name":"tool_catalog","tool_args":{"category":"Web探测","query":"headless"}}
{"action":"tool","tool_name":"headless_browser","tool_args":{"url":"http://127.0.0.1:8080","mode":"snapshot","wait_ms":"1500"}}
{"action":"tool","tool_name":"flag_scan","tool_args":{"root":".","limit":"80"}}
输出格式
## CTF 分析结果
### 题型判断
### 关键证据
### 已尝试路径
### Flag / 当前最佳结论
### 下一步
边界
- 不自动爆破真实账号，不做未授权公网攻击。
- 需要写脚本时先说明脚本目的、输入、输出和读写边界，再用
script_run请求确认。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +1 lines 2a626e1e0606
- 1mo ago First seen · 45 lines · 33 tokens per session scan A 2e817cde9647
ctf is a skill published in the GitHub repository asaotomo/DeepSentry (38 stars, last pushed 3d ago), licensed Apache-2.0. It adds 33 tokens to every session and 544 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
go-expert
Expert-level Go development with Go 1.22+ features, concurrency, standard library, and production-grade best practices. Use when the user mentions concurrency, microservices, or backend, or when the task involves idiomatic Go, goroutines and channels, context-based cancellation, or writing an HTTP server.
golang-testing
Go testing best practices including table-driven tests, test helpers, benchmarking, race detection, coverage analysis, and integration testing patterns. Use when writing or improving Go tests.
golang-patterns
Go-specific design patterns and best practices including functional options, small interfaces, dependency injection, concurrency patterns, error handling, and package organization. Use when working with Go code to apply idiomatic Go patterns.
skill-creator
Create, install, or update skills in the workspace. Use when (1) installing a skill from a URL or remote source, (2) creating a new skill from scratch, (3) updating or restructuring existing skills. Always use this skill for any skill installation or creation task.
image-generation
Generate or edit images from text prompts. Use when the user asks to create, draw, design, or edit an image, illustration, photo, icon, poster, or any visual content.
ax-go-gen
Use when writing Go code with github.com/ax-llm/ax/packages/go for AxGen programs, forward calls, indexed multi-sampling, result pickers, streaming, tools, assertions, traces, usage, and output parsing.