CtrlK
BlogDocsLog inGet started
Tessl Logo

competition-web-runtime

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for CTF web, API, SSR, frontend, queue-backed app, and routing challenges. Use when the user asks to inspect a site or API, follow real browser requests, debug auth or session flow, trace uploads or workers, find hidden routes, or explain why frontend and backend behavior diverge under sandbox-internal routing. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

70

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

77%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A concise, well-sequenced investigative workflow with clear checkpoints. It loses points on actionability (no executable commands/code) and progressive disclosure (a substantial bundle file goes unlinked while the cited reference is thin).

Suggestions

Add concrete, executable commands or tool invocations (e.g., curl/devtools snippets) to lift actionability from instructional to copy-paste ready.

Reference references/cookie-hmac-key-reuse-auth-bypass.md where auth/session flows are discussed, so the deeper material is actually reachable.

De-duplicate routing-runtime.md against the SKILL.md body so the reference adds distinct value rather than restating the checklist.

DimensionReasoningScore

Conciseness

The body is lean and assumes Claude's competence—short imperative steps and tight checklists with no padding or explanation of concepts Claude already knows.

3 / 3

Actionability

Guidance is concrete in intent ('Capture one real request flow end-to-end', 'Re-run the smallest flow with one variable changed') but is instructional rather than executable—no commands, code, or tool invocations to copy-paste.

2 / 3

Workflow Clarity

A clear three-stage sequence (Map runtime → Capture request order → Expand after proven) with numbered Quick Start steps and explicit checkpoint language ('only after the first flow is grounded').

3 / 3

Progressive Disclosure

The single one-level reference to routing-runtime.md is well signaled, but routing-runtime.md (28 lines) largely repeats the body while the substantial cookie-hmac-key-reuse-auth-bypass.md is never referenced, leaving the bundle structure underused.

2 / 3

Total

10

/

12

Passed

Description

92%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, explicit description with concrete actions, natural triggers, and a clear what/when structure. Its only weakness is broad scope that overlaps with the many sibling competition skills it routes to.

Suggestions

Tighten the description's scope so it is more clearly distinguishable from the sibling $competition-* skills it defers to (e.g., reserve this skill for multi-layer runtime tracing rather than any web challenge).

DimensionReasoningScore

Specificity

Lists multiple concrete actions—'inspect a site or API, follow real browser requests, debug auth or session flow, trace uploads or workers, find hidden routes'—matching the top anchor for naming several specific actions.

3 / 3

Completeness

Explicitly answers what ('CTF-sandbox workflow for web, API, SSR, frontend, queue-backed app, and routing challenges') and when ('Use when the user asks to inspect a site or API...'), satisfying the explicit-trigger requirement.

3 / 3

Trigger Term Quality

Covers natural terms a user would say—'inspect a site or API', 'follow real browser requests', 'debug auth or session flow', 'trace uploads or workers'—with strong coverage of common phrasings.

3 / 3

Distinctiveness Conflict Risk

The skill is a downstream specialization and overlaps with many sibling $competition-* skills it later references; the 'Use only after $ctf-sandbox-orchestrator' guard helps, but the broad web scope could still trigger for wrong sibling skills.

2 / 3

Total

11

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
zhaoxuya520/reverse-skill
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.