Skip to content
Get packs

CTF Web Runtime Analyst

Guides an agent through tracing web, API, and auth flows in sandboxed CTF challenges

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
4 files

What it does

This is a downstream helper for a larger CTF (capture-the-flag security competition) sandbox workflow. Once installed and invoked by its parent skill, it tells the agent how to investigate web applications: map the runtime, capture real browser and API requests in order, check cookies and storage together, and test one variable at a time. It also points the agent to about a dozen more specialized sibling skills for topics like SSRF, JWT, OAuth, and WebSocket issues.

Great for

  • CTF players working on web, API, or authentication challenges inside an authorized sandbox
  • Security students learning how browser state, routing, and backend checks interact
  • Teams who already use the ctf-sandbox-orchestrator skill and want a web-specific specialization

Skip it if

  • Testing live production sites or third-party systems you do not own or have permission to test, because the skill assumes hosts belong to a sandbox and gives no authorization check
  • Use without the parent ctf-sandbox-orchestrator skill, since it says it should only run after that skill has set sandbox assumptions and will otherwise send the agent back to it

Try asking

  • “Follow the login request flow on this sandboxed challenge site and tell me where the session cookie is checked”
  • “Find hidden routes in this CTF web app and show the exact requests that prove they exist”
  • “Explain why the frontend hides the admin panel but the API still responds to this request”
Step-by-step guide: how to use CTF Web Runtime AnalystInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 4 original files, the MIT licence and an attribution note.

    competition-web-runtime.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip competition-web-runtime.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip competition-web-runtime.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Install the parent ctf-sandbox-orchestrator skill first, or the agent will be sent back to it before doing any work
  • Only point it at sandbox or challenge hosts you are authorized to test, and keep the scope written down
  • Ask for one flow at a time so the agent can prove each step before expanding

What's inside

  • agents/openai.yaml
  • references/cookie-hmac-key-reuse-auth-bypass.md
  • references/routing-runtime.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.