ctf-web

Provides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client, template engine, identity flow, or smart-contract frontend/backend surface, including XSS, SQLi, SSTI, SSRF, XXE, JWT, auth bypass, file upload, request smuggling, OAuth/OIDC, SAML, prototype pollution, and similar web bugs. Do not use it for native binary memory corruption, reverse engineering of standalone executables, disk or memory forensics, or pure cryptanalysis unless the web flaw is still the main path to the flag.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

77%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The SKILL.md body is a well-structured, actionable routing guide with executable commands and a clear recon workflow, but it is undermined by missing bundle files: every detailed reference it points to is absent, so its progressive-disclosure promise is unfulfilled. Minor routing redundancy across three sections also leaves room to tighten the token budget.

Suggestions

Ship the referenced bundle files (sql-injection.md, server-side.md, server-side-2.md, server-side-exec.md, server-side-exec-2.md, server-side-deser.md, server-side-advanced.md through -4, client-side.md, client-side-advanced.md, auth-and-access.md, auth-and-access-2.md, auth-jwt.md, auth-infra.md, node-and-prototype.md, web3.md, cves.md, field-notes.md) under references/ so the one-level-deep navigation actually resolves.

Merge the overlapping routing in 'Additional Resources', 'Fast Pattern Map', and 'Deep-Dive Notes' into a single symptom-to-file map to remove redundancy and recover tokens.

Add one explicit verification checkpoint to the First-Pass Workflow (e.g., 'confirm the primitive reproduces before chaining') to make the feedback loop explicit rather than implied by 'smallest proof first'.

Dimension	Reasoning	Score
Conciseness	The body is terse and avoids explaining concepts Claude already knows, but the same file-routing appears in three overlapping sections ('Additional Resources', 'Fast Pattern Map', 'Deep-Dive Notes') and the resource one-liners are long, so it could be tightened. It is mostly efficient rather than perfectly lean.	2 / 3
Actionability	Provides fully executable, copy-paste-ready commands (pip/apt/brew/go installs, curl/ffuf/sqlmap/flask-unsign/jq invocations, SSTI probes) plus concrete recon paths and flag locations, matching the score-3 anchor.	3 / 3
Workflow Clarity	The 'First-Pass Workflow' is a clear numbered 5-step sequence with a gating checkpoint ('Build the smallest proof first') and a 'When to Pivot' redirect that acts as an error-recovery feedback loop, meeting the score-3 anchor.	3 / 3
Progressive Disclosure	As written the body is an excellent one-level-deep overview with well-signaled references, but none of the ~20 referenced .md files (sql-injection.md, server-side.md, field-notes.md, etc.) exist on disk — there are no references/scripts/assets directories — so the navigation is broken and the detail layer it promises is absent.	2 / 3
	Total	10 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is comprehensive, third-person, and tightly scoped: it states what the skill does, gives explicit use triggers with concrete bug-class keywords, and draws clear exclusion boundaries against sibling CTF skills. It is a strong, low-conflict routing description.

Dimension	Reasoning	Score
Specificity	Lists many concrete capabilities and bug classes ('XSS, SQLi, SSTI, SSRF, XXE, JWT, auth bypass, file upload, request smuggling, OAuth/OIDC, SAML, prototype pollution') across named target surfaces, matching the score-3 anchor of multiple specific concrete actions.	3 / 3
Completeness	Explicitly answers both 'what' ('Provides web exploitation techniques for CTF challenges') and 'when' with a detailed 'Use when...' clause plus a 'Do not use it for...' exclusion, matching the score-3 anchor.	3 / 3
Trigger Term Quality	Uses the natural terms a CTF user would actually say ('XSS', 'SQLi', 'SSRF', 'web exploitation', 'CTF challenges', 'HTTP application', 'API', 'browser client') with broad coverage and no over-reliance on abstract jargon.	3 / 3
Distinctiveness Conflict Risk	Clear web-CTF niche with explicit negative boundaries ('Do not use it for native binary memory corruption, reverse engineering...') that prevent conflicts with adjacent crypto/pwn/forensics/reverse skills.	3 / 3
	Total	12 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
relative_links	Relative link issues: 30 missing	Warning

	Total	14 / 16 Passed

Repository: ljagiello/ctf-skills
Path: ctf-web/SKILL.md
Commit: d19f35f

Reviewed: 9 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.