competition-supply-chain

Name: competition-supply-chain
Author: zhaoxuya520

8.8kstars1.4kforks

How to install competition-supply-chain?

zhaoxuya520/reverse-skill/competition-supply-chain

$npx -y skills add zhaoxuya520/reverse-skill --skill competition-supply-chain

Installs into the current project.

Summary

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for CI/CD, registry, dependency drift, artifact provenance, image build, release pipeline, and runtime consumer challenges. Use when the user asks to trace dependency drift, registry pulls, malicious pac

Files · 1

View on GitHub

SKILL.md

1	# Competition Supply Chain
2
3	Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4
5	Use this skill when the challenge is really about provenance, dependency drift, build output, release flow, or what runtime artifact actually got shipped.
6
7	Reply in Simplified Chinese unless the user explicitly requests English.
8
9	## Quick Start
10
11	1. Split the problem into source, dependency resolution, build, packaging, publish, and runtime consumption.
12	2. Decide where the first divergence occurs between intended artifact and runtime artifact.
13	3. Keep provenance as a compact chain, not a scattered set of observations.
14	4. Reproduce the smallest possible build or package path that still shows the issue.
15	5. Separate checked-in intent from what the pipeline actually emitted.
16
17	## Workflow
18
19	### 1. Trace Provenance End-To-End
20
21	- Map source checkout, lockfiles, dependency fetch, pre/post-install steps, build scripts, packaging, publish target, and runtime consumer.
22	- Compare declared version, resolved version, and shipped artifact.
23	- Note registry, cache, mirror, or CI environment differences.
24
25	### 2. Reconcile Build-Time And Runtime
26
27	- Compare manifests with image layers, mounted secrets, generated files, and runtime hooks.
28	- Identify whether the decisive mutation happens in dependency install, build step, publish step, or runtime bootstrap.
29
30	### 3. Report The Break Point
31
32	- State the earliest point where provenance diverges.
33	- Keep evidence in one short chain from source to runtime consumer.
34
35	## Read This Reference
36
37	- Load `references/supply-chain.md` for the provenance checklist, evidence packaging, and common pipeline failure modes.
38
39	## What To Preserve
40
41	- Declared dependency, resolved dependency, and runtime artifact versions
42	- CI step names, registry pulls, artifact hashes, and image or package layers
43	- The runtime consumer that actually accepts or executes the artifact

People who liked this also viewed

6 picks

Type

competition-supply-chain

8.8kstars1.4kforks

View on GitHub

How to install competition-supply-chain?

zhaoxuya520/reverse-skill/competition-supply-chain

$npx -y skills add zhaoxuya520/reverse-skill --skill competition-supply-chain

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Competition Supply Chain
2
3	Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4
5	Use this skill when the challenge is really about provenance, dependency drift, build output, release flow, or what runtime artifact actually got shipped.
6
7	Reply in Simplified Chinese unless the user explicitly requests English.
8
9	## Quick Start
10
11	1. Split the problem into source, dependency resolution, build, packaging, publish, and runtime consumption.
12	2. Decide where the first divergence occurs between intended artifact and runtime artifact.
13	3. Keep provenance as a compact chain, not a scattered set of observations.
14	4. Reproduce the smallest possible build or package path that still shows the issue.
15	5. Separate checked-in intent from what the pipeline actually emitted.
16
17	## Workflow
18
19	### 1. Trace Provenance End-To-End
20
21	- Map source checkout, lockfiles, dependency fetch, pre/post-install steps, build scripts, packaging, publish target, and runtime consumer.
22	- Compare declared version, resolved version, and shipped artifact.
23	- Note registry, cache, mirror, or CI environment differences.
24
25	### 2. Reconcile Build-Time And Runtime
26
27	- Compare manifests with image layers, mounted secrets, generated files, and runtime hooks.
28	- Identify whether the decisive mutation happens in dependency install, build step, publish step, or runtime bootstrap.
29
30	### 3. Report The Break Point
31
32	- State the earliest point where provenance diverges.
33	- Keep evidence in one short chain from source to runtime consumer.
34
35	## Read This Reference
36
37	- Load `references/supply-chain.md` for the provenance checklist, evidence packaging, and common pipeline failure modes.
38
39	## What To Preserve
40
41	- Declared dependency, resolved dependency, and runtime artifact versions
42	- CI step names, registry pulls, artifact hashes, and image or package layers
43	- The runtime consumer that actually accepts or executes the artifact

People who liked this also viewed

6 picks

Type