CTF sandbox entry (sidecar, not a second router)

ACTION REQUIRED (Execute immediately after reading)

1. NOW

   : Run

   ../scripts/case-init.ps1

   ; DO NOT perform any actions on the real external network until

   auth.status=granted

   . Use

   -NetworkProfile lab

   or

   offline

   for competitions/security labs.

2. NOW

   : Open

   ../../CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md

   in the package root directory, and proceed according to its sandbox assumptions.

3. MUST NOT

   : Add over 40

   competition-*

   sub-skills to

   routing.json

   . This entry is only a PRIMARY latch.

4. ACT

   : Let the orchestrator select a downstream

   competition-*

   sub-skill. When the specific question type is clear (pwn/ROP, APK, IDA), it should have been handled by a higher-priority rule in

   routing.json

   , so do not take over.

Why a separate layer

CTF-Sandbox-Orchestrator/

scope.md

Task Completion Self-Check (Must pass before claiming completion)

• Did I first run case-init / scope verification instead of treating "user mentioned CTF" as authorization for external network access?
• Did I open the sidecar orchestrator instead of treating the 40 sub-skills as PRIMARY?
• If the task is actually pwn/APK/IDA, did I let the more specific PRIMARY take over?