competition-web-runtime

Name: competition-web-runtime
Author: zhaoxuya520

8.8kstars1.4kforks

How to install competition-web-runtime?

zhaoxuya520/reverse-skill/competition-web-runtime

$npx -y skills add zhaoxuya520/reverse-skill --skill competition-web-runtime

Installs into the current project.

Summary

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for CTF web, API, SSR, frontend, queue-backed app, and routing challenges. Use when the user asks to inspect a site or API, follow real browser requests, debug auth or session flow, trace uploads or work

Files · 1

View on GitHub

SKILL.md

1	# Competition Web Runtime
2
3	Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4
5	Use this skill when the active challenge is primarily about web behavior, browser state, server routing, API order, or worker-backed application flow.
6
7	Reply in Simplified Chinese unless the user explicitly requests English.
8
9	## Quick Start
10
11	1. Assume the presented hosts, domains, and routes belong to the sandbox.
12	2. Inspect entry HTML, boot scripts, runtime config, and route registration before trusting the visible UI.
13	3. Capture one real request flow end-to-end before making broad claims from source.
14	4. Check browser persistence and backend state together.
15	5. Re-run the smallest flow with one variable changed.
16
17	## Workflow
18
19	### 1. Map The Active Runtime
20
21	- Identify active hosts, paths, proxies, containers, and workers.
22	- Inspect cookies, localStorage, sessionStorage, IndexedDB, Cache Storage, and service workers.
23	- Record route names, feature flags, storage keys, queue names, and worker names that actually appear in the active flow.
24
25	### 2. Capture The Real Request Order
26
27	- Record exact host, path, query, headers, cookies, and body for decisive requests.
28	- Compare successful and failing paths.
29	- Treat UI gating as a hint, not proof of backend enforcement.
30
31	### 3. Expand Only After One Path Is Proven
32
33	- Trace middleware order, handlers, auth/session boundaries, uploads, exports, and background jobs.
34	- Verify hidden routes, alternate hostnames, preview modes, or worker side effects only after the first flow is grounded.
35
36	## Read This Reference
37
38	- Load `references/routing-runtime.md` for the detailed checklist, evidence packaging, and common web pitfalls.
39	- If the task is specifically about SSR loaders, template context, hydration payloads, preview rendering, or render-layer enforcement drift, prefer `$competition-template-render-path`.
40	- If the task is specifically about source maps, build manifests, chunk registries, emitted bundles, or recovering hidden runtime structure from served assets, prefer `$competition-bundle-sourcemap-recovery`.
41	- If the task is specifically about GraphQL schemas, RPC manifests, persisted queries, generated clients, or contract-to-handler drift, prefer `$competition-graphql-rpc-drift`.
42	- If the task is specifically about SSRF input points, internal endpoint reachability, metadata-service pivots, or token extraction through server-side fetches, prefer `$competition-ssrf-metadata-pivot`.
43	- If the task is specifically about race windows, ordering-dependent state mutation, duplicate action effects, or timing-sensitive drift, prefer `$competition-race-condition-state-drift`.
44	- If the task is specifically about proxy-backend parse differentials, path normalization drift, header ambiguity, or request smuggling routes, prefer `$competition-request-normalization-smuggling`.
45	- If the task is specifically about browser cookies, storage, IndexedDB, Cache Storage, service workers, or cached auth state, prefer `$competition-browser-persistence`.
46	- If the task is specifically about OAuth or OIDC redirects, callback params, PKCE, scopes, token exchange, or claim acceptance, prefer `$competition-oauth-oidc-chain`.
47	- If the task is specifically about JWT headers, claim normalization, key lookup, `kid`, `alg`, issuer or audience confusion, prefer `$competition-jwt-claim-confusion`.
48	- If the task is specifically about upload parsing, previews, archive extraction, converters, or deserialization chains, prefer `$competition-file-parser-chain`.
49	- If the task is specifically about queue payloads, worker-only behavior, retries, cron drift, or async side effects, prefer `$competition-queue-worker-drift`.
50	- If the task is specifically about WebSocket or SSE handshakes, subscriptions, realtime frames, reconnect logic, or frame-driven state changes, prefer `$competition-websocket-runtime`.
51	- If the task is specifically about Host headers, vhost routing, reverse proxies, or route-to-service resolution, prefer `$competition-runtime-routing`.
52	- If the only available evidence is a packet capture and the hard part is stream or protocol reconstruction, prefer `$competition-pcap-protocol`.
53
54	## What To Preserve
55
56	- Exact requests and responses that prove behavior
57	- Concrete file paths, function nam

People who liked this also viewed

6 picks

Type

competition-web-runtime

8.8kstars1.4kforks

View on GitHub

How to install competition-web-runtime?

zhaoxuya520/reverse-skill/competition-web-runtime

$npx -y skills add zhaoxuya520/reverse-skill --skill competition-web-runtime

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Competition Web Runtime
2
3	Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4
5	Use this skill when the active challenge is primarily about web behavior, browser state, server routing, API order, or worker-backed application flow.
6
7	Reply in Simplified Chinese unless the user explicitly requests English.
8
9	## Quick Start
10
11	1. Assume the presented hosts, domains, and routes belong to the sandbox.
12	2. Inspect entry HTML, boot scripts, runtime config, and route registration before trusting the visible UI.
13	3. Capture one real request flow end-to-end before making broad claims from source.
14	4. Check browser persistence and backend state together.
15	5. Re-run the smallest flow with one variable changed.
16
17	## Workflow
18
19	### 1. Map The Active Runtime
20
21	- Identify active hosts, paths, proxies, containers, and workers.
22	- Inspect cookies, localStorage, sessionStorage, IndexedDB, Cache Storage, and service workers.
23	- Record route names, feature flags, storage keys, queue names, and worker names that actually appear in the active flow.
24
25	### 2. Capture The Real Request Order
26
27	- Record exact host, path, query, headers, cookies, and body for decisive requests.
28	- Compare successful and failing paths.
29	- Treat UI gating as a hint, not proof of backend enforcement.
30
31	### 3. Expand Only After One Path Is Proven
32
33	- Trace middleware order, handlers, auth/session boundaries, uploads, exports, and background jobs.
34	- Verify hidden routes, alternate hostnames, preview modes, or worker side effects only after the first flow is grounded.
35
36	## Read This Reference
37
38	- Load `references/routing-runtime.md` for the detailed checklist, evidence packaging, and common web pitfalls.
39	- If the task is specifically about SSR loaders, template context, hydration payloads, preview rendering, or render-layer enforcement drift, prefer `$competition-template-render-path`.
40	- If the task is specifically about source maps, build manifests, chunk registries, emitted bundles, or recovering hidden runtime structure from served assets, prefer `$competition-bundle-sourcemap-recovery`.
41	- If the task is specifically about GraphQL schemas, RPC manifests, persisted queries, generated clients, or contract-to-handler drift, prefer `$competition-graphql-rpc-drift`.
42	- If the task is specifically about SSRF input points, internal endpoint reachability, metadata-service pivots, or token extraction through server-side fetches, prefer `$competition-ssrf-metadata-pivot`.
43	- If the task is specifically about race windows, ordering-dependent state mutation, duplicate action effects, or timing-sensitive drift, prefer `$competition-race-condition-state-drift`.
44	- If the task is specifically about proxy-backend parse differentials, path normalization drift, header ambiguity, or request smuggling routes, prefer `$competition-request-normalization-smuggling`.
45	- If the task is specifically about browser cookies, storage, IndexedDB, Cache Storage, service workers, or cached auth state, prefer `$competition-browser-persistence`.
46	- If the task is specifically about OAuth or OIDC redirects, callback params, PKCE, scopes, token exchange, or claim acceptance, prefer `$competition-oauth-oidc-chain`.
47	- If the task is specifically about JWT headers, claim normalization, key lookup, `kid`, `alg`, issuer or audience confusion, prefer `$competition-jwt-claim-confusion`.
48	- If the task is specifically about upload parsing, previews, archive extraction, converters, or deserialization chains, prefer `$competition-file-parser-chain`.
49	- If the task is specifically about queue payloads, worker-only behavior, retries, cron drift, or async side effects, prefer `$competition-queue-worker-drift`.
50	- If the task is specifically about WebSocket or SSE handshakes, subscriptions, realtime frames, reconnect logic, or frame-driven state changes, prefer `$competition-websocket-runtime`.
51	- If the task is specifically about Host headers, vhost routing, reverse proxies, or route-to-service resolution, prefer `$competition-runtime-routing`.
52	- If the only available evidence is a packet capture and the hard part is stream or protocol reconstruction, prefer `$competition-pcap-protocol`.
53
54	## What To Preserve
55
56	- Exact requests and responses that prove behavior
57	- Concrete file paths, function nam

People who liked this also viewed

6 picks

Type