Skip to content
Get packs

Competition WebSocket Runtime

Traces WebSocket and SSE handshakes, frames, subscriptions and reconnect logic in CTF sandboxes.

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
3 files

What it does

This skill teaches an AI agent how to analyze realtime connections (WebSocket and Server-Sent Events) inside a capture-the-flag style training sandbox. Once installed, the agent maps the handshake, separates setup, subscription, keepalive and server-push messages, and links each frame to the state change it causes. It is a downstream helper meant to be used only after a parent skill, ctf-sandbox-orchestrator, has set up the sandbox assumptions.

Great for

  • Students working through CTF or security training labs that involve live, realtime traffic
  • Security practitioners analyzing a WebSocket or SSE flow in an authorized sandbox
  • Developers debugging how subscription messages and reconnect logic behave in their own application

Skip it if

  • Testing live systems you do not own or have written permission to assess, since the skill is designed to inspect auth material and reproduce handshake-plus-frame sequences
  • Simple one-off HTTP requests, which the skill's own description says are outside its scope

Try asking

  • “Map the WebSocket handshake for this sandbox app, including headers, cookies and the upgrade response”
  • “Decode the subscription and server-push frames and tell me which one changes the rendered page”
  • “Trace the reconnect logic after the connection drops and list the resulting state changes”
  • “Reduce the realtime flow to the smallest handshake-plus-frame sequence that reaches the flag-related state”
Step-by-step guide: how to use Competition WebSocket RuntimeInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    competition-websocket-runtime.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip competition-websocket-runtime.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip competition-websocket-runtime.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only use it inside a sandbox or lab you are authorized to test, and have ctf-sandbox-orchestrator set the scope first
  • Expect replies in Simplified Chinese by default; ask explicitly for English if you need it
  • Provide captured handshake and frame logs so the agent can reason from real evidence rather than guesses

What's inside

  • agents/openai.yaml
  • references/websocket-runtime.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.