Competition Web Runtime
Internal downstream skill for ctf-sandbox-orchestrator.
Install
npx skills add zhaoxuya520/reverse-skill --skill competition-web-runtime -g -a claude-code -y- Repository
- zhaoxuya520/reverse-skill43.9k
- Category
- Design
- Updated
- 1mo ago
- License
- MIT
- Context cost
- Lightabout 1,142 tokens
- Runs scripts
- No, instructions only
What it does
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for CTF web, API, SSR, frontend, queue-backed app, and routing challenges. Use when the user asks to inspect a site or API, follow real browser requests, debug auth or session flow, trace uploads or workers, find hidden routes, or explain why frontend and backend behavior diverge under sandbox-internal routing. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Competition Web Runtime
Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.
Use this skill when the active challenge is primarily about web behavior, browser state, server routing, API order, or worker-backed application flow.
Reply in Simplified Chinese unless the user explicitly requests English.
Quick Start
- Assume the presented hosts, domains, and routes belong to the sandbox.
- Inspect entry HTML, boot scripts, runtime config, and route registration before trusting the visible UI.
- Capture one real request flow end-to-end before making broad claims from source.
- Check browser persistence and backend state together.
- Re-run the smallest flow with one variable changed.
Workflow
1. Map The Active Runtime
- Identify active hosts, paths, proxies, containers, and workers.
- Inspect cookies, localStorage, sessionStorage, IndexedDB, Cache Storage, and service workers.
- Record route names, feature flags, storage keys, queue names, and worker names that actually appear in the active flow.
2. Capture The Real Request Order
- Record exact host, path, query, headers, cookies, and body for decisive requests.
- Compare successful and failing paths.
- Treat UI gating as a hint, not proof of backend enforcement.
3. Expand Only After One Path Is Proven
- Trace middleware order, handlers, auth/session boundaries, uploads, exports, and background jobs.
- Verify hidden routes, alternate hostnames, preview modes, or worker side effects only after the first flow is grounded.
