How to use the Competition Browser Persistence agent skill

What is an agent skill, and what does this one do?

An agent skill is a folder of instructions that an AI agent loads when a task matches it. This skill, named competition-browser-persistence, covers the browser-held side of a web challenge: the state that lives in the browser rather than only in visible HTML or backend source.

It guides the agent to identify the active persistence surface first, record origin, scope, domain, path, expiry and key names before changing anything, tie stored state to one concrete effect, and reproduce the smallest stateful sequence that reaches the decisive branch.

• Map browser state: cookies, localStorage, sessionStorage, IndexedDB, Cache Storage and service worker registrations.
• Trace how stored state becomes request headers, role checks, route visibility, cached API data or offline fallback behaviour.
• Compare clean-state and mutated-state runs, changing one variable at a time.
• Keep auth tokens, CSRF state, cached responses and feature toggles in separate evidence blocks.

Install the skill from the ZIP download

Download the ZIP for this skill from the download link on this page. The skill folder contains agents/openai.yaml, references/browser-persistence.md and SKILL.md. Unzip it into one of the following locations, depending on how you want to use it.

For a personal setup available across projects, unzip it into ~/.claude/skills/. For a single project, unzip it into that project's .claude/skills/ folder. If you use the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.

• Personal: ~/.claude/skills/
• Single project: the project's .claude/skills/ folder
• Claude apps: Settings → Capabilities → Skills, then upload

Install the parent skill too

This skill will not work as intended on its own. The source says the parent skill ctf-sandbox-orchestrator must be installed and active before this one is used. The skill itself tells the agent to return to $ctf-sandbox-orchestrator if that parent has not yet established sandbox assumptions, node ownership and evidence priorities.

Install the parent skill using the same method, then confirm both are available to your agent before you start a competition task.

How to trigger the skill with natural requests

You do not need special syntax. The skill's description lists the kinds of requests it matches: asking to inspect browser state, replay cached auth or session behaviour, explain why a page behaves differently after load, or trace how stored client state changes requests, rendering or access. Start with the parent skill's context, then ask about the browser state.

The skill also references $ctf-sandbox-orchestrator by name, so mentioning it in your request makes the routing explicit.

• Inspect the cookies and localStorage this training app sets after login, and tell me which values change the requests it sends.
• Why does the dashboard look different after a page reload? Check the sessionStorage and service worker cache.
• Replay the cached API response path with a clean browser state, then with the mutated localStorage key, and compare the results.
• Using $ctf-sandbox-orchestrator's sandbox setup, trace how the IndexedDB store affects which routes are visible.

What the agent will produce

The skill asks the agent to reply in Simplified Chinese unless you explicitly request English. Expect output organised around the decisive chain: initial page or login, then state persisted, then the subsequent request or render branch, then the resulting capability.

The reference checklist asks for each state item to be recorded with its origin, key, value shape, scope, expiry, and database or cache name, along with the runtime effect and the replay prerequisites.

• A list of state items, each tied to an origin and scope.
• The exact request or render effect each decisive item causes.
• Clean-state and mutated-state reproduction steps.

Safety notes: scripts, network and scope

The skill runs no scripts and uses no network access, according to its listing. It does not ship executable code of its own. It does depend on a browser or inspection tooling that the agent can use to read browser state, but the files do not specify which tools those are.

The skill is designed for sandboxed competition environments. Use it only on training apps, lab instances or challenges you are permitted to test. Do not point it at live production websites or systems you do not own or have permission to test.

• No scripts are included.
• No network use is declared.
• Keep testing inside an isolated lab or competition sandbox.