CtrlK
BlogDocsLog inGet started
Tessl Logo

competition-web-runtime

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for CTF web, API, SSR, frontend, queue-backed app, and routing challenges. Use when the user asks to inspect a site or API, follow real browser requests, debug auth or session flow, trace uploads or workers, find hidden routes, or explain why frontend and backend behavior diverge under sandbox-internal routing. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

69

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, mostly lean investigative workflow with concrete inspection guidance and a clear prove-before-expand sequence. The main gaps are tooling specifics for capturing flows, an unreferenced bundle file, and a heavy inline sibling-routing list.

Suggestions

Add specific tools or commands for capturing request flows (e.g., browser DevTools Network tab, curl, mitmproxy) to strengthen actionability beyond the 'what to inspect' level.

Reference the existing `references/cookie-hmac-key-reuse-auth-bypass.md` bundle file from the body, or remove it if unused, so every bundle asset is navigable from the overview.

Condense the 14-line sibling-skill routing list or move it into `references/routing-runtime.md` to tighten conciseness while preserving the disambiguation guidance.

DimensionReasoningScore

Conciseness

The body is lean and assumes Claude's competence, avoiding concept re-explanation; the 14-line sibling-skill routing list is useful navigation but token-heavy and could be trimmed or delegated to the reference file.

4 / 5

Actionability

Concrete, specific guidance names exact items to inspect and record (cookies, localStorage, IndexedDB, Cache Storage, service workers; host, path, query, headers, cookies, body), but it stays at the 'what' level and omits specific tools/commands for capturing request flows.

4 / 5

Workflow Clarity

A clear three-phase sequence with an explicit gating checkpoint ('Expand Only After One Path Is Proven') and a compare/re-run step; feedback loops for error recovery are implied rather than fully spelled out, leaving a minor validation gap.

4 / 5

Progressive Disclosure

Good section structure with a clearly signaled one-level-deep reference to `references/routing-runtime.md`; however the bundled `references/cookie-hmac-key-reuse-auth-bypass.md` is not navigated from the body, a minor organization gap.

4 / 5

Total

16

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-scoped description that clearly states what the skill does, when to use it, and how it differs from its orchestrator and sibling skills. The only minor gap is trigger-term breadth relative to the anchor-5 synonyms/extensions bar.

DimensionReasoningScore

Specificity

The description lists multiple concrete actions — 'inspect a site or API, follow real browser requests, debug auth or session flow, trace uploads or workers, find hidden routes, or explain why frontend and backend behavior diverge' — giving comprehensive coverage of the web-runtime domain.

5 / 5

Completeness

It explicitly answers both 'what' (CTF-sandbox workflow for web/API/SSR/frontend/queue/routing challenges) and 'when' via a concrete 'Use when the user asks to...' clause with multiple trigger phrases.

5 / 5

Trigger Term Quality

Natural user-facing phrases like 'inspect a site or API', 'debug auth or session flow', 'find hidden routes' read as things a user would actually say; a few synonyms are present but the anchor-5 bar of comprehensive synonyms and file extensions is not fully met for this runtime skill.

4 / 5

Distinctiveness Conflict Risk

It carves a clear niche as an internal downstream specialization gated on '$ctf-sandbox-orchestrator', and states 'Use only after ... has already established sandbox assumptions and routed here', minimizing overlap with sibling skills.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
zhaoxuya520/reverse-skill
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.