Automatically generate professional CTF writeups from solving sessions with flag detection, challenge categorization, and proper markdown formatting
This skill helps CTF players, security researchers, and cybersecurity educators automatically generate professional writeups from their solving sessions. It intelligently detects flag formats, categorizes challenges, structures the writeup with proper headings, and includes code blocks with syntax highlighting.
Perfect for:
Use this skill when the user:
Automatically detects and validates common CTF flag formats:
CTF{...}, FLAG{...}, flag{...}HTB{...}, THM{...}, SHAASTRA{...}, picoCTF{...}Automatically categorizes based on keywords and tools used:
Generates properly formatted markdown writeups with:
Proper syntax highlighting for:
When a user requests a CTF writeup, follow this workflow:
Gather Information Ask the user for:
Process the Content
Generate the Writeup Create a markdown document with this structure:
# [Challenge Name] - [Platform] CTF Writeup
**Author**: [Author name or handle]
**Date**: [Current date]
**Category**: [Category]
**Difficulty**: [Difficulty]
**Points**: [Points if applicable]
## Summary
[2-3 sentence overview of the challenge and solution approach]
## Challenge Description
[Original challenge description if provided]
## Reconnaissance
[Initial enumeration and information gathering]
## Solution
### Step 1: [Phase name]
[Detailed explanation with commands/code]
```bash
# Commands used
[Continue with logical progression]
FLAG{...}
Validate and Enhance
Save the Writeup
Save the generated writeup to a markdown file named:
[platform]_[challenge-name]_writeup.md
User: "I just solved the 'Binary Bash' challenge from Shaastra CTF. It was a buffer overflow where I had to overwrite the return address. The flag was Shaastra{buff3r_0v3rfl0w_m4st3r}. Can you generate a writeup?"
Agent Response:
ghidra-skill for reverse engineering analysisburpsuite-skill for web exploitationvolatility-skill for memory forensicsSupport for different writeup styles:
Users can customize via environment variables:
# Set default author name
export CTF_AUTHOR="akm626"
# Set default CTF platform
export CTF_PLATFORM="HackTheBox"
# Set preferred writeup style
export CTF_WRITEUP_STYLE="tutorial"
# Enable automatic screenshot embedding
export CTF_AUTO_SCREENSHOTS=true
For a web exploitation challenge:
# SQL Injection Master - Shaastra CTF 2026
**Author**: akm626
**Date**: February 08, 2026
**Category**: Web Exploitation
**Difficulty**: Medium
**Points**: 300
## Summary
This challenge involved exploiting a SQL injection vulnerability in a login form to extract database contents and retrieve the flag. The application used client-side filtering which was easily bypassed.
## Challenge Description
[Original description...]
## Reconnaissance
Initial enumeration revealed a PHP-based login portal running on Apache. Basic directory fuzzing found:
```bash
ffuf -w common.txt -u http://target.com/FUZZ
admin/
backup/
config/
Testing the login form with basic SQL injection payloads:
' OR '1'='1' --
admin' --
' UNION SELECT NULL--
Used SQLMap to automate extraction:
sqlmap -u "http://target.com/login.php" --data="username=admin&password=test" \
--technique=U --dump --batch
[Continue with detailed steps...]
SHAASTRA{sql_inj3ct10n_pr0}
## Contributing
Users can improve this skill by:
- Adding new flag format patterns
- Contributing platform-specific templates
- Enhancing categorization logic
- Sharing example writeups
## License
MIT License - Free to use and modify
## Support
For issues or suggestions, contact the skill maintainer or file an issue on the GitHub repository.