Guide · Agent skill
How to use the Competition Supply Chain agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The competition-supply-chain skill is a specialist add-on for an AI agent working on capture-the-flag (CTF) challenges about software supply chains. It gives the agent a checklist for tracing how code becomes a shipped artifact, from dependencies and lockfiles through build, packaging and publishing to what the runtime actually loads. This guide explains what the skill does, how to install it, how to ask for it, and the limits you should respect.
Competition Supply Chainzhaoxuya520/reverse-skill · MIT Download the skill Quick start
- 1Install the parent skill. Install and activate ctf-sandbox-orchestrator, because this skill routes back to it and will not work as a standalone tool.
- 2Download this skill's ZIP. Download the competition-supply-chain ZIP from this page.
- 3Unzip it into a skills folder. Unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder.
- 4Or upload it in the Claude apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the ZIP.
- 5Ask a natural question. Describe the CTF challenge and the provenance question, such as tracing dependency drift or which artifact the runtime consumes.
What is an agent skill, and what does this one do?
An agent skill is a folder of instructions and reference files that an AI agent loads when a task matches the skill's description. This one is designed for CTF challenges where the question is about provenance: whether the artifact that was intended to ship is the one the runtime really uses.
Once active, the agent works through a fixed order: source checkout, dependency declaration, lockfile or resolver result, build step, packaging or signing, publish target, and runtime consumer. It compares declared versions, resolved versions and the shipped artifact, and looks for the earliest point where they diverge, such as dependency version drift or a tampered build.
- Traces dependency drift between source, lockfile and fetched artifact
- Checks registry or mirror pulls against the expected origin
- Looks at build scripts with preinstall, prepare, postinstall or codegen steps
- Compares signed or packaged artifact hashes with the runtime-loaded artifact
Check the parent skill first
This skill is not standalone. It is meant to run only after the parent skill, ctf-sandbox-orchestrator, is installed and active and has set the sandbox assumptions. If the parent has not run, the skill tells the agent to return to the parent first.
Install the parent skill before this one, and make sure both are active in the session you use.
Install the competition-supply-chain skill
Download the skill ZIP from this page and unzip it into your personal skills folder at ~/.claude/skills/, or into a project's .claude/skills/ folder if you want it available only in that project.
In the Claude apps you can instead upload the ZIP under Settings → Capabilities → Skills.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into the project's .claude/skills/ folder
- Claude apps: upload the ZIP under Settings → Capabilities → Skills
Trigger the skill with natural requests
You do not need a special command. The agent loads the skill when your request matches its description, which covers tracing dependency drift, registry pulls, malicious packages, build or release tampering, CI execution, artifact signing, and which shipped artifact the runtime consumes.
Be specific about the challenge and mention the chain you care about. The skill expects the sandbox rules to be set first, so state that the work is a CTF exercise.
- Trace where the declared lodash version diverges from what the lockfile resolved in this challenge repo.
- Check whether the runtime loads the artifact we signed or a different build from the registry.
- Find the first step in the CI log where the published package differs from the source.
What it needs before you start
The skill needs the parent skill installed and active. It also needs access to the challenge's source, lockfiles, build logs and images. The skill files do not say how that access is provided, so set it up as your challenge environment requires.
The agent is told to reply in Simplified Chinese unless you explicitly ask for English, so say so in your request if you want English replies.
Safety notes: scripts and network
The skill is documented as not running scripts and not using the network. It does not limit the commands the agent can run, however, and it assumes a sandboxed CTF setting.
Do not point this skill at a live production pipeline or any real system you are not authorised to test. Keep it to isolated challenge environments.
- Runs scripts: no
- Uses network: no
- Assumes a sandboxed CTF setting and does not restrict commands
- Not for auditing or changing live production pipelines
What people use it for
- Tracing where a declared dependency version differs from the version a lockfile resolved in a CTF challenge repo
- Checking whether a runtime loads the artifact that was signed, or a different build pulled from a registry
- Locating the earliest CI step where a published package diverges from the source
- Comparing build-time manifests with image layers and runtime hooks in a lab environment
Frequently asked questions
Is the competition-supply-chain skill free?
The skill is published under the MIT licence. Check the licence text on the repository for the terms that apply to your use.
Does it need anything else installed?
Yes. The parent skill ctf-sandbox-orchestrator must be installed and active, and you need access to the challenge's source, lockfiles, build logs and images.
Where do I put the skill files?
Unzip the downloaded ZIP into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. You can also upload the ZIP under Settings → Capabilities → Skills in the Claude apps.
Why does the agent answer in Chinese?
The skill instructs the agent to reply in Simplified Chinese unless English is explicitly requested. Ask for English in your request to change this.
Can I use this skill to audit a live production pipeline?
No. The skill assumes a sandboxed CTF setting and does not limit commands, so it should not be pointed at real systems without authorisation.
How is this different from a general build debugging tool?
It is narrow. It focuses on provenance and security analysis, such as dependency drift and tampered builds, rather than everyday build errors or general software builds.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits students and competitors working on CTF challenges about CI/CD, dependency confusion or build tampering, and security practitioners studying provenance in a lab. It is a poor fit for everyday debugging, general builds, or any live production pipeline, and it only works once the parent ctf-sandbox-orchestrator skill is installed.
Download the skill