ctf-web

Provides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client, template engine, identity flow, or smart-contract frontend/backend surface, including XSS, SQLi, SSTI, SSRF, XXE, JWT, auth bypass, file upload, request smuggling, OAuth/OIDC, SAML, prototype pollution, and similar web bugs. Do not use it for native binary memory corruption, reverse engineering of standalone executables, disk or memory forensics, or pure cryptanalysis unless the web flaw is still the main path to the flag.

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is an effective, actionable routing guide with a clear recon workflow and copy-paste command examples. Its main defect is progressive disclosure: the Additional Resources list points to roughly twenty markdown files and an install script that are not present in the bundle, undermining the otherwise excellent one-level-deep navigation structure.

Suggestions

Ship the referenced reference markdown files (sql-injection.md, server-side*.md, client-side*.md, auth-*.md, field-notes.md, pat-reference.md, etc.) or remove their links from the Additional Resources list so navigation does not dead-end.

Add scripts/install_ctf_tools.sh (referenced in Prerequisites) or replace those commands with the inline git-clone fallback already shown.

De-duplicate the PayloadsAllTheThings graceful-degrade explanation, which currently appears in Prerequisites, the Bulk payloads section, and the lazy-clone block.

Dimension	Reasoning	Score
Conciseness	The body is mostly lean operational prose—short bullets, copy-paste commands, and one-line resource summaries—assuming Claude's competence, but the PAT graceful-degrade / lazy-clone idea is repeated in three places (Prerequisites, Bulk payloads, and the lazy-clone block) and could be trimmed.	4 / 5
Actionability	Quick Start Commands and the install/SSTI/JWT/Flask-unsign one-liners are concrete and copy-paste ready and the First-Pass Workflow is actionable, but the referenced install script (scripts/install_ctf_tools.sh) does not exist in the bundle, a minor gap in executability.	4 / 5
Workflow Clarity	The First-Pass Workflow gives a clear 5-step sequence (identify boundary, capture baselines, enumerate, classify, build smallest proof) supported by Common Chain Shapes and a Fast Pattern Map, with only minor implicit-checkpoint gaps appropriate to a recon skill.	4 / 5
Progressive Disclosure	The overview is well organized with one-level-deep, clearly signaled references and per-file summaries, but scoring against the actual bundle shows ~20 referenced .md files (sql-injection.md, server-side*.md, etc.) and scripts/install_ctf_tools.sh are all missing—only scripts/async_fuzz.py exists—so the navigation leads mostly to nonexistent files.	3 / 5
	Total	15 / 20 Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description with explicit Use-when triggers, comprehensive natural keyword coverage, and clear boundary guidance distinguishing it from adjacent CTF skills. The only weakness is that the lead action verb ("Provides... techniques") is generic even though the enumerated bug classes are highly specific.

Dimension	Reasoning	Score
Specificity	The description lists many concrete vulnerability categories ("XSS, SQLi, SSTI, SSRF, XXE, JWT, auth bypass, file upload, request smuggling, OAuth/OIDC, SAML, prototype pollution") giving comprehensive domain coverage, but the action verb "Provides web exploitation techniques" is generic rather than naming discrete actions, so it sits below the 5 anchor.	4 / 5
Completeness	It explicitly answers both what ("Provides web exploitation techniques for CTF challenges" plus the enumeration) and when ("Use when the target is primarily an HTTP application, API, browser client...") with concrete trigger phrases, and adds negative boundary guidance.	5 / 5
Trigger Term Quality	It covers the full set of natural terms a CTF player would actually say (XSS, SQLi, SSTI, SSRF, XXE, JWT, OAuth/OIDC, SAML, prototype pollution, file upload, request smuggling) plus synonyms and surface types, matching the comprehensive-coverage anchor.	5 / 5
Distinctiveness Conflict Risk	It carves a clear CTF-web niche with distinct triggers and an explicit "Do not use it for native binary memory corruption, reverse engineering... disk or memory forensics, or pure cryptanalysis" exclusion, minimizing conflict with sibling ctf-* skills.	5 / 5
	Total	19 / 20 Passed

Validation

81%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 13 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
relative_links	Relative link issues: 33 missing	Warning
referenced_paths_exist	Referenced path issues: 2 missing	Warning

	Total	13 / 16 Passed

Repository: ljagiello/ctf-skills
Path: ctf-web/SKILL.md
Commit: c332c7b

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.