# Competition Runtime Routing

Internal downstream skill for ctf-sandbox-orchestrator.

- Repository: https://github.com/zhaoxuya520/reverse-skill (43923 stars)
- Category: Engineering
- License: MIT
- Last updated: 2026-09-22
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add zhaoxuya520/reverse-skill --skill competition-runtime-routing -g -a claude-code -y`
Codex: `npx skills add zhaoxuya520/reverse-skill --skill competition-runtime-routing -g -a codex -y`
Cursor: `npx skills add zhaoxuya520/reverse-skill --skill competition-runtime-routing -g -a cursor -y`
Gemini CLI: `npx skills add zhaoxuya520/reverse-skill --skill competition-runtime-routing -g -a gemini-cli -y`

## Description

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for reverse proxies, Host headers, forwarded headers, vhost routing, websocket upgrades, path-prefix rewriting, base-URL derivation, and multi-node route resolution. Use when the user asks which host or container serves a route, why a public-looking domain still belongs to the sandbox, how headers or proxies change behavior, or how a route resolves across proxy, container, and worker boundaries. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Competition Runtime Routing

Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.

Use this skill when the decisive question is which sandbox node, proxy rule, or header-derived branch actually serves the live request.

Reply in Simplified Chinese unless the user explicitly requests English.

## Quick Start

1. Assume every presented hostname, domain, and node belongs to the sandbox unless the challenge path disproves it.
2. Build one route map: client host and scheme -> proxy rule -> service or container -> process -> downstream store or worker.
3. Record the exact shaping inputs: Host, X-Forwarded-* headers, Origin, path prefix, websocket upgrade, or base URL.
4. Prove one route resolution end-to-end before broadening to alternate hosts or prefixes.
5. Re-run the same request with one routing input changed at a time.

## Workflow

### 1. Map Route Inputs

- Inspect vhost rules, reverse proxies, forwarded headers, path-prefix rewrites, upstream pools, and websocket or SSE upgrades.
- Note which parts of the request influence routing or app behavior: host, scheme, port, path, prefix, cookie scope, or origin.
- Treat public-looking domains, cloud hostnames, and separate VPS nodes as sandbox routing fixtures first.

### 2. Trace Route To Live Consumer

- Map hostname to proxy rule to container or process to port to downstream service.
- Compare checked-in proxy intent against live listeners, mounted configs, runtime env, and observed traffic.
- Keep headers, proxy config, and live request traces tied together in one evidence chain.

### 3. Prove The Decisive Deviation

The rest: https://github.com/zhaoxuya520/reverse-skill/blob/HEAD/CTF-Sandbox-Orchestrator/competition-runtime-routing/SKILL.md