Skip to content
Get packs

Competition Browser Persistence

Guides an agent to inspect browser-stored state (cookies, storage, service workers) during CTF sandbox work

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
3 files

What it does

This is a specialist add-on for an AI agent that is used in capture-the-flag (CTF) security competitions. It teaches the agent how to examine what a web page stores in the browser, such as cookies, localStorage, IndexedDB and service worker caches, and how that stored state changes the page's requests or behaviour. It is meant to be used only after a parent skill (ctf-sandbox-orchestrator) has set up the sandbox context, and it tells the agent to respond in Simplified Chinese by default.

Great for

  • CTF players analysing how a training web app keeps login or session state in the browser
  • Students learning how client-side persistence affects authentication and page behaviour in a sandbox
  • Security trainers building reproducible stateful exercises inside an isolated lab

Skip it if

  • Testing live production websites or systems you do not own or have permission to test, since the skill is designed for sandboxed competition environments
  • Use outside the parent orchestrator workflow, because the skill itself says it should only run after that parent skill has been activated

Try asking

  • “Explain why this sandbox page shows a different view after I reload it, by inspecting its stored state”
  • “Trace how the auth token in localStorage changes the request headers this app sends”
  • “List the cookies, cache entries and service worker scopes for this challenge origin and show what each one affects”
Step-by-step guide: how to use Competition Browser PersistenceInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    competition-browser-persistence.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip competition-browser-persistence.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip competition-browser-persistence.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only use it inside a sandbox or lab you are authorised to test, and start with the parent orchestrator skill so the scope is set first
  • Ask for clean-state versus mutated-state comparisons to isolate which stored value causes the behaviour
  • Check the bundled reference file for the checklists it points to, since the main SKILL.md is brief

What's inside

  • agents/openai.yaml
  • references/browser-persistence.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.