Guide · Agent skill
How to use the Competition OAuth/OIDC Chain Tracer agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
competition-oauth-oidc-chain is an agent skill for capture-the-flag style exercises about login systems that use OAuth or OpenID Connect (OIDC). It tells an AI agent to map each step of a login flow, from the starting request through redirects, callback parameters and token exchange, to the service that finally accepts the identity. This guide explains what the skill does, how to install it, how to trigger it, and what it needs before it will run.
Competition OAuth/OIDC Chain Tracerzhaoxuya520/reverse-skill · MIT Download the skill Quick start
- 1Confirm the sandbox setup. Make sure you are working on an authorized CTF or lab exercise and that ctf-sandbox-orchestrator is installed and active.
- 2Download and unzip the skill. Download the ZIP of competition-oauth-oidc-chain from this page and unzip it to get the skill folder.
- 3Place the skill folder. Copy the folder into ~/.claude/skills/ for all projects, or into the .claude/skills/ folder of one project.
- 4Or upload the ZIP in the Claude apps. In the Claude apps, open Settings, then Capabilities, then Skills, and upload the ZIP file.
- 5Start with the parent skill. Ask the agent to set up the sandbox assumptions with ctf-sandbox-orchestrator before any auth-chain work.
- 6Ask a specific auth-chain question. Name the redirect, callback, token or claim you are investigating and share the evidence you have.
- 7Review the minimal flow. Check the ordered chain and the single replayable sequence the agent returns, and confirm where the identity is accepted.
What is an agent skill, and what does this one do?
An agent skill is a folder of instructions (a SKILL.md file plus optional reference files) that an AI agent loads when a request matches the skill's description. It changes how the agent approaches a specific kind of task.
This skill is a specialist instruction set. When it is active, the agent records the authorize request, redirect URIs, callback parameters, scopes, state, nonce and PKCE material, then follows how tokens are exchanged, refreshed and mapped to claims. The goal is to show where a token or claim becomes an accepted app identity or privilege. The skill tells the agent to keep one compact chain and to preserve evidence before changing anything.
- Maps the chain in order: entry route, redirect, authorize request, callback, token exchange, refresh, and final accepting service.
- Separates token possession from actual identity acceptance, and UI login success from backend authorization success.
- Reduces the result to one canonical flow and, if a parameter change matters, one minimal mutated flow.
- Uses references/oauth-oidc-chain.md as a checklist for redirects, tokens and evidence packaging.
Check the requirements before you install
This skill is a downstream skill. It is written to run only after the parent skill ctf-sandbox-orchestrator is active and has set up the sandbox assumptions. If you use it alone, the skill says to return to the parent first.
The listing requires the parent skill ctf-sandbox-orchestrator and the reference file references/oauth-oidc-chain.md, which is included in the repository. The skill is meant for sandboxed exercises, not live systems.
- Parent skill: ctf-sandbox-orchestrator must be installed and active first.
- Included files: agents/openai.yaml, references/oauth-oidc-chain.md and SKILL.md.
- Runs scripts: no. Uses network: no.
Install the skill from the ZIP
Download the ZIP of the skill from this page and unzip it. Then place the skill folder in one of the two locations below. Use the user-level folder if you want the skill available in all your projects, or the project folder if you want it limited to one project.
You can also upload the ZIP in the Claude apps. Go to Settings, then Capabilities, then Skills, and upload the file there.
- User-level: ~/.claude/skills/
- Project-level: the .claude/skills/ folder inside your project
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
- Install the parent skill ctf-sandbox-orchestrator the same way.
~/.claude/skills/How do you trigger the skill with natural requests?
You do not need a special command. The agent loads the skill when your request matches its description. The description covers redirects, callback parameters, scopes, state, nonce, PKCE, refresh tokens, consent, and how an OAuth or OIDC chain leads to accepted identity or privilege.
Start with the parent skill so the sandbox context is set. Then ask a specific question about the auth chain. Name the step you are stuck on, and say what evidence you have.
- "Using the ctf-sandbox-orchestrator setup, trace the redirects and callback parameters in this OAuth login challenge."
- "Check whether the state and nonce values in this callback are validated before the session is created."
- "Explain how the refresh token in this lab turns into accepted privilege."
- "Map the token exchange from code to the ID token and show which service accepts it."
What output should you expect?
The agent replies in Simplified Chinese unless you explicitly ask for English. Expect it to list the chain in order and to record the values the skill asks it to keep: redirect URIs, parameters, codes, token claims, scopes, and the accepting service or callback.
The skill asks the agent to point to the exact place where claims or tokens are accepted, and to give you one minimal sequence you can replay.
- An ordered chain from entry request to resulting capability.
- Token details: claims, expiration, audience, subject and scopes.
- A minimal replayable redirect-to-acceptance sequence.
- A note on whether a step is UI success or backend authorization success.
Safety notes: scripts, network and scope
According to the listing, the skill runs no scripts and uses no network. It works through instructions the agent follows. Its scope is limited to sandboxed exercises. The listing warns that probing live accounts or third-party services without authorization could be illegal.
If the problem moves into JWT header parsing, claim normalization, key lookup or token validation after issuance, the skill says to prefer the competition-jwt-claim-confusion skill. If the task broadens into generic web routing or storage behavior outside the auth chain, the skill says to switch back to the broader web-runtime skill.
- Use only in a sandbox or lab you are authorized to test.
- Do not use it on production login systems or third-party services you are not authorized to test.
- The skill focuses on tracing and exploiting flows, not on hardening guidance.
Tips for better results
Give the agent the evidence you already have, such as captured redirects, callback URLs and token claims. The skill asks it to record these before mutating anything, so starting with them saves time.
Keep each request to one decisive edge in the chain. If you have several unrelated problems, handle them in separate requests.
- Run the parent skill first, every time.
- Share the issuer, client ID and redirect URI when you have them.
- Ask whether a token is only possessed or actually accepted by the app.
- Ask for one minimal replayable flow rather than a full walkthrough.
What people use it for
- Tracing how an authorization code is returned in a callback and exchanged for tokens in a CTF login challenge.
- Checking whether state and nonce values are validated before a session is created, as a lab exercise.
- Following how a refresh token is used and which service accepts the resulting identity.
- Studying how PKCE and redirect URI handling affect login acceptance in a sandboxed OIDC setup.
- Packaging evidence of a login flow into one minimal, replayable sequence for a write-up.
Frequently asked questions
How do I install the competition-oauth-oidc-chain skill?
Download the ZIP of the skill from this page and unzip it. Place the folder in ~/.claude/skills/ for all projects or in the .claude/skills/ folder of a project. You can also upload the ZIP in the Claude apps under Settings, then Capabilities, then Skills.
What does the skill need to work?
It requires the parent skill ctf-sandbox-orchestrator, which must be active first, and the reference file references/oauth-oidc-chain.md, which is included in the repository. The listing says it runs no scripts and uses no network.
Is the skill free to use?
The listing states the licence is MIT. Check the repository licence file for the full terms before reuse.
Can I use it on its own without the parent skill?
The skill says it should not be used on its own. It is written to run after ctf-sandbox-orchestrator has set up the sandbox assumptions, and it tells the agent to return to that parent skill first if that has not happened.
Why isn't the skill triggering for my OAuth question?
Check that ctf-sandbox-orchestrator is installed and active, and that the folder is in the right location. Ask a question that names redirects, callback parameters, state, nonce, PKCE, refresh tokens or token acceptance, since these match the skill's description.
Which skill should I use for JWT problems, and how does this one compare?
For JWT header parsing, claim normalization, key lookup or token validation after issuance, the skill points to competition-jwt-claim-confusion. This skill focuses on the OAuth and OIDC chain from redirect to accepted identity.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits students and competitors working on OAuth or OIDC challenges in a CTF sandbox, and practitioners studying how redirect, state, nonce and PKCE handling affects login acceptance in a lab. It is not for testing live or third-party login systems without authorization, and it is not for developers who only want to build a secure login, since it does not give hardening guidance.
Download the skill