competition-browser-persistence

Name: competition-browser-persistence
Author: zhaoxuya520

8.8kstars1.4kforks

How to install competition-browser-persistence?

zhaoxuya520/reverse-skill/competition-browser-persistence

$npx -y skills add zhaoxuya520/reverse-skill --skill competition-browser-persistence

Installs into the current project.

Summary

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for browser cookies, localStorage, sessionStorage, IndexedDB, Cache Storage, service workers, offline caches, and client-side session persistence. Use when the user asks to inspect browser state, replay

Files · 1

View on GitHub

SKILL.md

1	# Competition Browser Persistence
2
3	Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4
5	Use this skill when the decisive branch lives in browser-held state rather than only in visible HTML or backend source.
6
7	Reply in Simplified Chinese unless the user explicitly requests English.
8
9	## Quick Start
10
11	1. Identify the active persistence surface first: cookie jar, localStorage, sessionStorage, IndexedDB, Cache Storage, or service worker.
12	2. Record origin, scope, domain, path, expiry, and key names before mutating state.
13	3. Tie stored state to one concrete effect: request header, rendered branch, cached response, offline behavior, or hidden route access.
14	4. Separate boot-time state from runtime-mutated state.
15	5. Reproduce the smallest stateful sequence that reaches the decisive branch.
16
17	## Workflow
18
19	### 1. Map Browser State Surfaces
20
21	- Inspect cookies, storage buckets, service worker registrations, cache entries, and transient globals exposed during boot.
22	- Record which origin, host, route, or feature flag each state item actually applies to.
23	- Keep auth tokens, refresh material, CSRF state, cached responses, and feature toggles in separate evidence blocks.
24
25	### 2. Tie State To Runtime Behavior
26
27	- Show how stored state becomes request headers, role derivation, route visibility, cached API data, or offline fallback behavior.
28	- Compare clean-state and mutated-state runs with one variable changed at a time.
29	- Distinguish UI-only state from backend-accepted state.
30
31	### 3. Reduce To The Decisive Persistence Chain
32
33	- Compress the result to the smallest chain: initial page or login -> state persisted -> subsequent request or render branch -> resulting capability.
34	- Keep extracted storage, service worker scripts, and replay steps tied to the same origin and route.
35	- If the problem broadens into general web routing or worker behavior outside browser persistence, switch back to the broader web-runtime skill.
36
37	## Read This Reference
38
39	- Load `references/browser-persistence.md` for the browser-state checklist, service-worker checklist, and evidence packaging.
40
41	## What To Preserve
42
43	- Cookie attributes, storage keys, database names, cache keys, service worker scopes, and origin boundaries
44	- The exact request or render effect caused by each decisive state item
45	- Clean-state vs mutated-state reproduction steps for the smallest working path

People who liked this also viewed

6 picks

Type

competition-browser-persistence

8.8kstars1.4kforks

View on GitHub

How to install competition-browser-persistence?

zhaoxuya520/reverse-skill/competition-browser-persistence

$npx -y skills add zhaoxuya520/reverse-skill --skill competition-browser-persistence

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Competition Browser Persistence
2
3	Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4
5	Use this skill when the decisive branch lives in browser-held state rather than only in visible HTML or backend source.
6
7	Reply in Simplified Chinese unless the user explicitly requests English.
8
9	## Quick Start
10
11	1. Identify the active persistence surface first: cookie jar, localStorage, sessionStorage, IndexedDB, Cache Storage, or service worker.
12	2. Record origin, scope, domain, path, expiry, and key names before mutating state.
13	3. Tie stored state to one concrete effect: request header, rendered branch, cached response, offline behavior, or hidden route access.
14	4. Separate boot-time state from runtime-mutated state.
15	5. Reproduce the smallest stateful sequence that reaches the decisive branch.
16
17	## Workflow
18
19	### 1. Map Browser State Surfaces
20
21	- Inspect cookies, storage buckets, service worker registrations, cache entries, and transient globals exposed during boot.
22	- Record which origin, host, route, or feature flag each state item actually applies to.
23	- Keep auth tokens, refresh material, CSRF state, cached responses, and feature toggles in separate evidence blocks.
24
25	### 2. Tie State To Runtime Behavior
26
27	- Show how stored state becomes request headers, role derivation, route visibility, cached API data, or offline fallback behavior.
28	- Compare clean-state and mutated-state runs with one variable changed at a time.
29	- Distinguish UI-only state from backend-accepted state.
30
31	### 3. Reduce To The Decisive Persistence Chain
32
33	- Compress the result to the smallest chain: initial page or login -> state persisted -> subsequent request or render branch -> resulting capability.
34	- Keep extracted storage, service worker scripts, and replay steps tied to the same origin and route.
35	- If the problem broadens into general web routing or worker behavior outside browser persistence, switch back to the broader web-runtime skill.
36
37	## Read This Reference
38
39	- Load `references/browser-persistence.md` for the browser-state checklist, service-worker checklist, and evidence packaging.
40
41	## What To Preserve
42
43	- Cookie attributes, storage keys, database names, cache keys, service worker scopes, and origin boundaries
44	- The exact request or render effect caused by each decisive state item
45	- Clean-state vs mutated-state reproduction steps for the smallest working path

People who liked this also viewed

6 picks

Type