ctf-super-hub: a router and prompt pack for CTF beginners, not a solver

The problem is picking a first move, not owning tools

The README states the target failure mode directly: not that you lack tools, but that after receiving a challenge you do not know what the first step should be. The three symptoms it lists are being unable to classify a challenge as Web, Crypto, Reverse, Pwn or Misc, not knowing which of many skill names to call first, and not knowing which command to type. That framing matters, because it defines the audience narrowly. This is for people who already have an AI agent with a skills directory and who freeze at the classification step. It is not for someone who wants a tool that ingests a binary and returns a flag. The repository positions itself as a unified entry point that reorganises a group of existing CTF and reverse engineering skills around the act of starting a challenge, with an explicitly beginner-facing tone. The README also spends several paragraphs explaining what a skill is at all, which tells you the assumed reader has never installed one.

Two hubs, an enhancement layer, and three output styles

The architecture described in the README is a two-tier routing scheme. The main entry is ctf-super-hub, which the README calls the default recommendation if you only remember one name. A second entry, ctf-beginner-hub, points in the same direction but uses gentler wording and is aimed at people new to CTF or put off by terminology. Below the hub sits what the README calls an enhancement layer: strix-* skills, which are not a second main system but are invoked only for Web, interface and vulnerability verification actions. So the flow is hub first, specialised ctf-* skill second, strix-* only when the task involves exercising a live target. On top of routing, the hub exposes three output styles: teaching, competition and hints-only. Hints-only is the most distinctive of the three, because the README describes it as withholding the full solution and giving only what to look up next and why. The README gives four ready-made prompt templates, one per style plus a brainstorm variant, and the default template explicitly asks the agent to fall back to a minimal brainstorm when there is not enough information to classify the challenge.

Routing has two paths: classify first, or brainstorm first

The README splits operation into two modes. In the automatic routing mode, you supply material such as a challenge statement, an attachment, a URL, an IP:PORT pair, source code or an executable, and the hub does three things: decide which category the challenge most resembles, decide whether to hand off to a more specific ctf-* or strix-* skill, and return only the one to three next steps worth doing. In the brainstorm-first mode, used when you cannot tell what the challenge is asking or do not know whether your material is sufficient, the hub instead clarifies the objective, sorts the clues from the missing information, and only then decides which skill to call. The README also notes that if you misjudge the category halfway through, you can switch direction and keep going. That mid-challenge re-routing is the one behaviour that distinguishes this from a static cheat sheet, and it is the reason the classification step is presented as provisional rather than as a verdict. There is no described mechanism for how classification is performed: no model, no heuristic list, no scoring. The skill files themselves are the mechanism, and the README does not reproduce them.

Installing means copying skill folders into an agent's skills directory

Everything starts by cloning the repository and entering the export directory, which the README shows as git clone https://github.com/asdfgh1445/ctf-super-hub.git followed by cd ctf-super-hub/skills-export. For Codex, the README calls the bundled script the easiest route: ./install-to-codex.sh from inside skills-export, which defaults to ~/.codex/skills, or ./install-to-codex.sh /path/to/your/skills-dir for a custom target. The README states the script creates the target directory, backs up any skill with a colliding name, and copies the relevant skills across. For Claude Code, Gemini CLI and OpenCode there is no script, only a manual copy into a conventional directory: mkdir -p ~/.claude/skills, then cd into skills-export, then cp -R brainstorming solve-challenge ctf-* strix-* ~/.claude/skills/. The same pattern repeats with ~/.gemini/skills and ~/.opencode/skills, and the README concedes that OpenCode's skills directory varies by version, so the path is a guess you may need to replace. Verification is equally manual: ls ~/.codex/skills/ctf-super-hub and check that SKILL.md is present, or open a fresh session and send the hub a throwaway classification prompt. The README's own troubleshooting list names three causes of failure, and the third is the interesting one: running cp -R from outside skills-export. It shows a zsh 'no matches found' error as the symptom, which is a glob-expansion failure rather than a copy failure, and that is the kind of detail a beginner will hit immediately.

The failure modes are installation and the absence of any solver

The most concrete limitation is that this repository contains instructions, not capability. The README says plainly that a skill is a document telling the AI how to work, and that it is not a challenge bank, not a plugin marketplace, and not something you must write code to run. That means every result depends on the host agent's own reasoning and tool access. If your agent cannot run commands or read a binary, ctf-super-hub will still classify the challenge and still suggest next steps, and nothing further will happen. The second limitation is the install surface. Four agents are covered, three of them by a copy command whose destination path is a convention the README admits may be wrong, and only Codex gets a script. The README does not state how many skill folders the glob patterns match, so you cannot predict the size of the copy before running it, and it does not describe what the backup step in install-to-codex.sh does when it finds a collision beyond the word backup. The third is the licence. The repository metadata reports NOASSERTION, which means no licence could be determined from the repository, and the README's only licence reference is a badge image. Nothing in the supplied material states the terms under which the skill text may be redistributed or modified, and that is a genuine gap for anyone planning to vendor these folders into an internal toolchain.

Against a general-purpose agent with no skill pack

The honest alternative is not another CTF repository. It is the same AI agent with no skill pack installed, driven by a well-written prompt that names the categories and asks for a classification plus one to three next steps. That approach costs nothing to install, has no directory to get wrong, and no licence question. The difference in approach is where the knowledge lives. With no skill pack, the classification rubric exists only in whatever you typed, so it drifts between sessions and between teammates. ctf-super-hub moves that rubric into named files on disk, which makes it repeatable and lets the hub hand off to a narrower ctf-* skill without you restating the rules. What it does not do is add knowledge the host model lacks. A second alternative for the reverse engineering half specifically is a dedicated disassembler or decompiler, which actually parses the binary. ctf-super-hub will route you toward reverse engineering and tell you what to inspect; it will not disassemble anything. Those two tools are complementary, and the README never claims otherwise.

Maintenance cost and what the repository does not pin down

The last push recorded for the repository is 2026-04-23, and no releases were retrieved, so there is no versioned artefact to track and no changelog to read. Upgrading therefore means re-cloning and re-running the copy commands, which will overwrite the folder contents in your skills directory. That is tolerable for Codex, where the README says the installer backs up colliding skills first, and less comfortable for Claude Code, Gemini CLI and OpenCode, where cp -R overwrites silently. The practical mitigation is to copy into a scratch path first and diff against your live skills directory before replacing anything. On licence, the metadata reports NOASSERTION and the README offers only a badge, so the redistribution terms are unspecified in the material available; treat that as an open question to resolve with the repository owner rather than an assumption. There is also a language consideration worth flagging for non-Chinese readers: the README, the prompt templates and the skill names are written in Chinese, so the hub's teaching and hints-only output will most likely come back in Chinese unless the skill files specify otherwise, which the supplied material does not show.

Editorial conclusion

Adopt ctf-super-hub if you already drive an AI coding agent and your actual bottleneck is the first move on an unfamiliar challenge; skip it if you need a working exploit chain or a tool that parses binaries by itself, because the repository ships instructions rather than solvers. Before trusting it, run the Codex installer into a scratch directory such as ./install-to-codex.sh /tmp/skills-test and inspect the copied SKILL.md files, since the README never states what the installer overwrites or how many skill folders it moves.

Official sources

1. asdfgh1445/ctf-super-hub on GitHub
2. Issues
3. README