Skill

competition-web-runtime

skill:zhaoxuya520/reverse-skill#competition-web-runtime

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for CTF web, API, SSR, frontend, queue-backed app, and routing challenges. Use when the user asks to inspect a site or API, follow real browser requests, debug auth or session flow, trace uploads or workers, find hidden routes, or explain why frontend and backend behavior diverge under sandbox-internal routing. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 21:28 UTC at cab634b

findings

medium

highest severity

threat classes

632

files scanned

104/104

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:CTF-Sandbox-Orchestrator/competition-web-runtime:CTF-Sandbox-Orchestrator/competition-web-runtime/references/cookie-hmac-key-reuse-auth-bypass.md:118:PRIVESC
suspicious: finding skill:CTF-Sandbox-Orchestrator/competition-web-runtime:CTF-Sandbox-Orchestrator/competition-web-runtime/references/cookie-hmac-key-reuse-auth-bypass.md:135:PRIVESC

Security findings 2

Privilege escalation

mediumContextual riskmedium confidence

The reference walkthrough instructs the agent to harvest the access token from the challenge entry URL, confirm the target reuses that token as the HMAC-SHA256 key for session cookies, forge an admin_session cookie with {admin:true}, and send it to https://target/api/admin/me via curl -k to verify unauthorized admin access on the target application.

CTF-Sandbox-Orchestrator/competition-web-runtime/references/cookie-hmac-key-reuse-auth-bypass.md:118

curl -k -H

vector:instruction

Counter-argument considered

Step 6 is not passive documentation but a directed command binding the Step 5 forged admin_session cookie into a live request to https://target/api/admin/me (a source-to-sink chain), and the detector confirms this network capability is 'not declared anywhere'; no carve-out (education material, declared core, sandbox install) covers an agent-executed forged-credential request against an arbitrary target, so no gate fails.

Privilege escalation

mediumContextual riskmedium confidence

The reference ships an immediately invoked browser payload (exploit()) that derives an HMAC-SHA256 key from the access token in the URL path, forges an admin_session cookie claiming {admin:true}, writes it into the challenge origin via document.cookie, and reloads the page to activate admin privileges.

CTF-Sandbox-Orchestrator/competition-web-runtime/references/cookie-hmac-key-reuse-auth-bypass.md:135

document.cookie = `admin_session=${payload}.${sigB64}; path=/; Secure`;

vector:code

Counter-argument considered

The payload is an immediately invoked exploit() chaining the URL access token (source) through WebCrypto HMAC signing to a document.cookie write of a forged {admin:true} admin_session cookie and a reload (sink), an active privilege-escalation write no carve-out (hook shim, LD_PRELOAD, build cleanup) covers and no declared claim (D14, D26-D30) declares, so no gate fails.

Open questions 3

What the analysis could not settle from the code alone.

Whether the documented Steps 1-6 and the browser exploit() payload are meant to be executed autonomously by the agent upon routing or only consulted as on-demand reference material is not determined by the shown units.

Privilege escalation

[file request CTF-Sandbox-Orchestrator/competition-web-runtime/references/cookie-hmac-key-reuse-auth-bypass.md] Do the remaining steps of this reference restrict the exploitation target behind https://target to sandbox-internal challenge instances, or require explicit user authorization before forged-credential requests are sent?

Privilege escalation

[file request CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md] Does the parent $ctf-sandbox-orchestrator skill restrict active-exploitation targets (the host behind placeholders like https://target) to sandbox-internal challenge instances, and does it require explicit user authorization before forged-credential requests are sent?

Privilege escalation

Refuted findings 1

Candidates the review stage examined and rejected, kept for transparency.

Privilege escalation

highRefutedmedium confidence

The skill's only exploitation-scope control is instructing the agent to assume the presented hosts, domains, and routes belong to the sandbox, and it nowhere requires explicit user authorization before active-exploitation or forged-credential requests.

CTF-Sandbox-Orchestrator/competition-web-runtime/SKILL.md:16

Assume the presented hosts, domains, and routes belong to the sandbox.

Why it was refuted

The fully served SKILL.md shows the flagged assume-sandbox step is the openly declared operating posture of a CTF-sandbox skill whose use is gated on the parent orchestrator having already established node ownership, with a further scope-pacing control ('Expand Only After One Path Is Proven') and no instruction anywhere to actively exploit or forge credentials; the claim that line 16 is the only exploitation-scope control is contradicted by these declared/mitigating lines.