Skip to content
Get packs

Cloud Metadata Path (CTF)

Guides an agent through proving how cloud metadata credentials become accepted privilege in a CTF sandbox.

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
3 files

What it does

This is a specialist instruction set for an AI agent working on capture-the-flag (CTF) security exercises involving cloud metadata services, the internal endpoints cloud machines use to hand out identity tokens. When active, the agent maps how a request reaches the metadata endpoint, records how the response becomes a usable credential, and traces whether the cloud or cluster accepts that credential. It is explicitly a downstream skill: it is meant to run only after a parent skill, ctf-sandbox-orchestrator, has set up sandbox assumptions, and it replies in Simplified Chinese by default.

Great for

  • Participants in CTF or lab competitions working on cloud identity challenges
  • Security students learning how instance and workload identity can be abused in a controlled sandbox
  • Red-team trainers building reproducible cloud metadata exercises

Skip it if

  • Production or real third-party systems: the instructions are about reproducing metadata-to-privilege chains, and using them against systems you do not own or have permission to test is illegal and harmful
  • Users without the parent ctf-sandbox-orchestrator skill: the file says it should not be used standalone, so it may give incomplete or misdirected guidance

Try asking

  • “Inspect whether this sandbox's instance metadata endpoint is reachable from a pod and what role name it exposes”
  • “Explain how the metadata token I retrieved turns into accepted cloud API access in this CTF challenge”
  • “Build the smallest replayable chain from SSRF to metadata to accepted privilege for our lab writeup”
Step-by-step guide: how to use Cloud Metadata Path (CTF)Install, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    competition-cloud-metadata-path.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip competition-cloud-metadata-path.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip competition-cloud-metadata-path.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Install and activate ctf-sandbox-orchestrator first, since this skill tells the agent to return there if assumptions are missing
  • Confirm the target is an isolated lab you own before asking the agent to probe metadata endpoints
  • Ask for compact evidence blocks (endpoint, role, token scope, accepting API) to keep writeups reproducible

What's inside

  • agents/openai.yaml
  • references/cloud-metadata-path.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.