ctf-similar-search
Searches for similar CTF challenge writeups using Tavily API for search and content extraction. Use when the user requests finding related challenges, when solve-challenge has failed multiple times and needs reference solutions, or when first identifying a challenge type and seeking examples.
- Installs
- 283
- Last 24h
- +32
- Trending rank
- #4282
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/ljagiello/ctf-skills --skill ctf-similar-search- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads ctf-similar-search automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
CTF Similar Challenge Search
Search for similar CTF challenge writeups using Tavily API.
Prerequisites
pip install requests tavily
Set your Tavily API key (from https://tavily.com) before running:
export TAVILY_API_KEY='tvly-...'
API Overview
This skill provides two interfaces:
| Interface | Purpose | Command |
|---|---|---|
| Tavily Search | Search for writeups and articles | ./search.sh search <keyword> |
| Tavily Extract | Extract content from URLs | ./search.sh extract <url1> [url2] ... |
Search Workflow
Step 1: Search with Keywords
Choose keywords based on available information:
Scenario 1: Known Competition + Challenge Name
# Format: [Competition Name] [Challenge Name] — max 3 words
./search.sh search "DASCTF URL Storage"
./search.sh search "HGAME baby web"
./search.sh search "BUUCTF pwn1"
Scenario 2: Challenge Name Only (no competition info)
# Use challenge name directly — max 3 words
./search.sh search "URL Storage"
./search.sh search "baby overflow"
./search.sh search "crypto-rsa"
Scenario 3: Unique Identifiers (code snippets, strings)
# Use unique, non-trivial strings from the challenge — NO word limit
./search.sh search "def encrypt_flag(key): return base64"
./search.sh search "CUSTOM_MAGIC_BYTES"
./search.sh search "ERROR: invalid padding in AES block"
⚠️ Critical: 3-Word Limit for Non-Code Queries
All keyword searches that are NOT code snippets or unique identifier strings MUST NOT exceed 3 words. This constraint ensures precise, focused queries that return relevant CTF writeup results instead of broad, diluted searches.
| Search Type | Word Limit | Examples |
|---|---|---|
| Competition + Challenge name | ≤ 3 words | "DASCTF URL Storage", "HGAME baby web" |
| Challenge name only | ≤ 3 words | "URL Storage", "baby overflow" |
| Code snippets / strings | No limit | "def encrypt_flag(key): return base64" |
| Error messages / identifiers | No limit | "CUSTOM_MAGIC_BYTES", "ERROR: invalid padding in AES block" |
For competition + challenge name searches, drop filler words (year numbers, "CTF", "competition", "writeup", "solution") and keep only the 3 most distinctive words:
- ❌
"HGAME 2024 baby web challenge"(5 words) - ✅
"HGAME baby web"(3 words) - ❌
"DASCTF 2023 URL Storage writeup"(5 words) - ✅
"DASCTF URL Storage"(3 words) - ❌
"PlaidCTF 2025 zero day exploit solution"(6 words) - ✅
"PlaidCTF zero day"(3 words)
For code/string searches, use the entire unique snippet — these are exempt from the word limit:
- ✅
"def xor_encrypt(data, key):"(code — exempt) - ✅
"ERROR: invalid padding in AES block"(error string — exempt) - ✅
"CUSTOM_MAGIC_BYTES"(identifier — exempt)
Keyword Rules
| ✅ Good Keywords | ❌ Bad Keywords |
|---|---|
| Competition + Challenge name (≤3 words) | Single vulnerability type (SSRF, XSS) |
| Challenge name (≤3 words) | Generic terms (web, pwn, crypto) |
| Unique code snippets (no word limit) | Full sentences |
| Specific error messages (no word limit) | Articles (a, the, in) |
| Library/framework names | Generic strings (flag{}, etc.) |
| Custom function names | Tool names alone |
Why avoid these?
- "SSRF" → returns generic vulnerability explanations, not CTF writeups
- "flag{" → returns millions of unrelated results
- "URL Storage DASCTF" → returns specific CTF challenges
Why the 3-word limit?
- Forces precision: only the most distinctive keywords survive
- Filters noise: filler words like "challenge", "writeup", "solution" dilute results
- Improves API efficiency: shorter, focused queries consume fewer credits
Key principle: Use keywords that uniquely identify THIS challenge, not the general technique or common patterns. Keep non-code queries to 3 words or fewer.
Step 2: Review Search Results
The search returns:
- Answer: AI-generated summary if available
- Results: List of URLs with titles and content previews
- Credits: API usage information
Step 3: Extract Content (Optional)
If a search result looks promising, extract its full content:
# Single URL
./search.sh extract "https://example.com/writeup"
# Multiple URLs
./search.sh extract "https://url1.com" "https://url2.com"
Step 4: Analyze and Pivot
Based on extracted content:
- Identify common techniques used in similar challenges
- Determine if the approach is applicable
- Pivot to category-specific skill if needed
When to Pivot
- If the challenge is already well-categorized, use the specific
ctf-*skill - If you need OSINT techniques, use
ctf-osint - If you need to generate a writeup after solving, use
ctf-writeup
Quick Start
# Scenario 1: Competition + Challenge name (≤3 words)
./search.sh search "DASCTF URL Storage"
# Scenario 2: Challenge name only (≤3 words)
./search.sh search "URL Storage"
# Scenario 3: Unique identifier from challenge (no word limit)
./search.sh search "def xor_encrypt(data, key):"
./search.sh search "ERROR: invalid padding"
# Extract content from promising results
./search.sh extract "https://ctftime.org/writeup/12345"
Tips
- Be specific: Use competition name + challenge name when available
- Use unique strings: Code snippets, error messages, unique identifiers
- Avoid generic terms: Don't search "SSRF CTF writeup" - too broad
- Review first: Check search results before extracting
- Extract selectively: Only extract URLs that look relevant
- Respect the 3-word limit: For non-code queries, strip filler words and keep only the 3 most distinctive keywords
$ARGUMENTS
FAQ
What does the ctf-similar-search skill do?
Searches for similar CTF challenge writeups using Tavily API for search and content extraction. Use when the user requests finding related challenges, when solve-challenge has failed multiple times and needs reference solutions, or when first identifying a challenge type and seeking examples.
How do I install ctf-similar-search?
Run npx skills add https://github.com/ljagiello/ctf-skills --skill ctf-similar-search in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/ctf-similar-search/ (personal) or .claude/skills/ctf-similar-search/ (project).
Which AI agents can use ctf-similar-search?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is ctf-similar-search safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains ctf-similar-search?
It is published by ljagiello in ljagiello/ctf-skills. It has 283 recorded installs.
More from ljagiello/ctf-skills
ctf-reverse
ljagiello/ctf-skills
Provides reverse engineering techniques for CTF challenges. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, game clients, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.
ctf-web
ljagiello/ctf-skills
Provides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client, template engine, identity flow, or smart-contract frontend/backend surface, including XSS, SQLi, SSTI, SSRF, XXE, JWT, auth bypass, file upload, request smuggling, OAuth/OIDC, SAML, prototype pollution, and similar web bugs. Do not use it for native binary memory corruption, reverse engineering of standalone executables, disk or memory forensics, or pure cryptanalysis unless the web flaw is still the main path to the flag.
ctf-pwn
ljagiello/ctf-skills
Provides binary exploitation techniques for CTF challenges. Use when you already have a vulnerable native target or service and need to turn memory corruption or low-level primitives into code execution or privilege escalation, such as buffer overflows, format strings, heap bugs, ROP, ret2libc, shellcode, kernel exploitation, seccomp bypass, sandbox escape, or Windows/Linux exploit chains. Do not use it when the main blocker is understanding what the binary does; use reverse engineering first. Do not use it for pure web bugs, disk or packet forensics, or standalone crypto/math challenges.
ctf-crypto
ljagiello/ctf-skills
Provides cryptography attack techniques for CTF challenges. Use when attacking encryption, hashing, signatures, ZKP, PRNG, or mathematical crypto problems involving RSA, AES, ECC, lattices, LWE, CVP, number theory, Coppersmith, Pollard, Wiener, padding oracle, GCM, key derivation, or stream/block cipher weaknesses.
ctf-osint
ljagiello/ctf-skills
Provides open source intelligence techniques for CTF challenges. Use when gathering information from public sources, social media, geolocation, DNS records, username enumeration, reverse image search, Google dorking, Wayback Machine, Tor relays, FEC filings, or identifying unknown data like hashes and coordinates.
ctf-forensics
ljagiello/ctf-skills
Provides digital forensics and signal analysis techniques for CTF challenges. Use when analyzing disk images, memory dumps, event logs, network captures, cryptocurrency transactions, steganography, PDF analysis, Windows registry, Volatility, PCAP, Docker images, coredumps, side-channel power traces, DTMF audio spectrograms, packet timing analysis, CD audio disc images, or recovering deleted files and credentials.
Popular backend & apis skills
find-skills
vercel-labs/skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
google-agents-cli-adk-code
google/agents-cli
This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).
embedded-captions
heygen-com/hyperframes
Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.
entra-agent-id
microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
neon
neondatabase/agent-skills
Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.