How to use the Cloud Metadata Path (CTF) agent skill

What does the skill make the agent do?

The skill is a downstream specialist. It covers cloud metadata services (the internal endpoints cloud machines use to hand out identity tokens), instance identity, workload identity, link-local credential paths, role assumption, and the trust edges that turn metadata-derived credentials into accepted cloud or control-plane privilege.

When it is active, the agent follows a three-part workflow from its SKILL.md: map how a request reaches the metadata endpoint, prove how the metadata response becomes usable credential material, and reduce the result to the shortest chain from reaching surface to metadata call to issued credential to accepted action. It also keeps evidence such as token format, role identity, scope and the accepting API in compact blocks.

By default the skill tells the agent to reply in Simplified Chinese unless the user explicitly asks for English.

• Maps the reaching surface: local process, pod, container, proxy, SSRF surface, sidecar or host route.
• Separates metadata reachability from credential issuance and from downstream privilege acceptance.
• Records role name, subject, audience, issuer, expiration and account mapping where they matter.
• Hands off to the tighter control-plane skill if the challenge narrows to RBAC or cluster changes after credentials are issued.

How do you install the skill from the ZIP?

Download the ZIP for competition-cloud-metadata-path from our page, then unzip it into one of two locations. Use your personal skills folder to make the skill available in all projects, or a project folder to limit it to one project.

If you use the Claude apps instead of a folder on disk, you can upload the skill through Settings, then Capabilities, then Skills.

The package contains agents/openai.yaml, references/cloud-metadata-path.md and SKILL.md. Keep that folder structure intact so the agent can find the reference checklist.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into your project's .claude/skills/ folder
• Claude apps: Settings → Capabilities → Skills, then upload

How do you trigger the skill with a natural request?

The skill's description lists the kinds of request that should activate it, so describe your task in those terms. Examples include asking the agent to inspect metadata-service access, instance credentials, pod or workload identity, link-local token paths, SSRF-to-metadata escalation, or how metadata-derived credentials become accepted privilege.

The description also says the skill should only run after the parent skill, $ctf-sandbox-orchestrator, has set up sandbox assumptions and routed the task here. Start your session with that parent skill, then ask your metadata question. If you skip this, the agent may give incomplete or misdirected guidance.

• Inspect how this pod reaches the instance metadata service in our sandbox and record the reaching path.
• Explain how the workload identity token in this CTF challenge becomes accepted cloud privilege.
• Trace whether the role assumed from the instance credential is accepted by the downstream cloud API.

What does a typical exercise look like?

The reference checklist describes the chain the agent should reconstruct: reachable path to metadata established, metadata response or token obtained, usable identity or credential material extracted, downstream API or trust edge accepts it, and the resulting privilege or artifact confirmed.

The agent keeps evidence in three groups: the reachability side (route, headers, namespace, container or proxy path), the identity side (role name, token claims, expiration, audience, issuer, account or project binding) and the acceptance side (the API action, resource access, secret read or spawned workload effect). The checklist warns against stopping after proving metadata access without proving a useful credential was obtained.

• Keep the reaching surface and the metadata endpoint in one chain.
• Distinguish raw metadata from usable credential material.
• Aim for the smallest replayable metadata-to-privilege chain that proves the challenge edge.

What does the skill need and what are the safety limits?

The skill requires access to the parent skill $ctf-sandbox-orchestrator and a CTF sandbox environment. The files do not name specific cloud SDKs, tools or API keys, so you bring those yourself as your sandbox provides them. The skill does not run scripts, but it does use the network, so it is only appropriate where network activity is part of an authorised sandbox.

The skill is for controlled sandboxes you own or have permission to test. Its own description says it should not be used against production or real third-party systems, because using these chains against systems you do not own or lack permission to test is illegal and harmful. Do not use it standalone without the parent skill.

• Use only inside a CTF or lab sandbox.
• Do not point it at production or third-party systems.
• Expect no script execution from the package; network calls are part of the workflow.

What tips help the most?

Name the metadata surface up front (instance metadata, workload identity, node identity, task role or a platform token endpoint). The first step of the skill asks the agent to identify it, and a clear starting point saves time.

If the hard part is first proving a server-side fetch primitive, SSRF reachability or internal endpoint traversal before metadata itself, the skill points you to $competition-ssrf-metadata-pivot instead. Ask the agent to keep token format, role identity and scope in compact evidence blocks so your write-up is easy to replay.

• Name the metadata surface before you start.
• Use $competition-ssrf-metadata-pivot when the blocker is SSRF rather than metadata.
• Ask for compact evidence blocks you can paste into a write-up.