How to use the Competition Container Runtime agent skill

What the skill makes the agent do

Agent skills are folders of instructions that an AI agent loads when a request matches them. This one covers live container runtime analysis inside a CTF sandbox. The agent is guided to compare the manifest (compose or Kubernetes) with what is really running: mounted secrets, sidecars, init containers, namespaces, entrypoints and the route from a hostname through a reverse proxy to the right container.

The skill asks the agent to split intent from reality, map host to proxy to container to mounted volume to consuming process, and report the earliest point where the live runtime diverges from the checked-in config. It keeps one compact evidence chain from manifest intent to live behaviour.

Check the requirements before you install

This skill is a downstream specialisation. It is meant to be used only after the parent skill $ctf-sandbox-orchestrator is already active and has set up the sandbox assumptions. The skill says it should not be used on its own, so install the parent first.

You also need access to the running containers or cluster you are inspecting. The skill works from live state, not from files you supply. It does not run scripts and does not use the network, according to the skill's listing.

• Parent skill: $ctf-sandbox-orchestrator, active first
• Access to the running containers or cluster being inspected
• Authorised sandbox use only

Install the skill from the ZIP

Download the ZIP for competition-container-runtime from the page. Unzip it into one of two places, depending on how you want to use it.

For a personal setup, put the unzipped folder in ~/.claude/skills/. For a single project, put it in that project's .claude/skills/ folder.

In the Claude apps you can instead upload the skill under Settings → Capabilities → Skills.

• Personal: ~/.claude/skills/competition-container-runtime
• Project only: .claude/skills/competition-container-runtime
• Claude apps: Settings → Capabilities → Skills, then upload

Trigger the skill with natural requests

You do not need a special command. The skill loads when your request matches its description: why a live container differs from its manifests, where a mounted secret is consumed, how a sidecar or init container changes runtime state, or which route resolves to which live container.

Start with the parent skill so sandbox assumptions are set, then ask a concrete runtime question. Name the container, pod, mount path or hostname where you can, because the skill keeps identifiers such as container IDs, pod names and mount paths in its evidence.

• Why does the running container's env differ from the compose file?
• Where is the database secret actually read in this pod?
• Does the init container change the config the main container uses?
• Which hostname routes to which live container?

Read the output and what to expect

The skill asks the agent to reply in Simplified Chinese by default, unless you explicitly request English. The output should name the earliest runtime deviation and include the exact route or file path that only becomes reachable at runtime.

The reference checklist covers comparing manifests, images, entrypoints, init containers, sidecars, mounted volumes, runtime env and live listeners. It flags common deviations such as rendered secrets written to shared volumes and reverse-proxy routes that expose an internal path only after startup.

• Manifest intent block
• Live mounts, processes or rendered files block
• Route or behaviour reached only because of runtime state

Know when another skill fits better

The skill points to other specialist skills for adjacent problems. Use $competition-k8s-control-plane for kube API permissions, RBAC, admission mutations or controller-created drift. Use $competition-runtime-routing for Host-header routing and path-prefix rewriting. Use $competition-kernel-container-escape for container-to-host questions, and $competition-linux-credential-pivot for secrets and host-to-host pivots after a container foothold.