Skip to content
Get packs

Competition Supply Chain

Traces where a build or release artifact diverges from what the runtime actually consumes

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
3 files

What it does

This is a specialist add-on for an AI agent working on CTF (capture-the-flag) security challenges about software supply chains. Once installed, the agent follows a checklist to trace how code becomes a shipped artifact: dependencies, lockfiles, build scripts, packaging, publishing and what the runtime actually loads. It looks for the first point where the intended artifact and the real one differ, such as dependency version drift or tampered builds. It is designed to run only after a parent skill, ctf-sandbox-orchestrator, has set the sandbox rules, and it tells the agent to reply in Simplified Chinese unless English is requested.

Great for

  • Students or competitors working on CTF challenges about CI/CD, dependency confusion or build tampering
  • Security practitioners studying how artifact provenance breaks in a lab environment
  • Developers wanting a structured checklist for comparing declared versus resolved dependency versions

Skip it if

  • Auditing or changing a live production pipeline: the skill assumes a sandboxed CTF setting and does not limit commands, so it should not be pointed at real systems without authorisation.
  • Users who have not installed the parent ctf-sandbox-orchestrator skill: the file says it should route back to that parent first, so it is not a standalone tool.
  • General software builds or everyday debugging: the scope is narrow and focused on provenance and security analysis.

Try asking

  • “Trace where the dependency version declared in my lockfile diverges from the version actually shipped in the container image.”
  • “Help me find the first point in this CI/CD pipeline where the build output was changed before release.”
  • “Compare the artifact hashes and image layers of this challenge against the runtime consumer and report the break point.”
Step-by-step guide: how to use Competition Supply ChainInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    competition-supply-chain.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip competition-supply-chain.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip competition-supply-chain.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Install and activate ctf-sandbox-orchestrator first, since this skill is meant to be routed to from it.
  • Provide the lockfile, build logs and image manifest up front so the agent can compare declared and shipped versions.
  • Keep the work inside an isolated lab; the skill itself does not add sandboxing.

What's inside

  • agents/openai.yaml
  • references/supply-chain.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.