How to use the SSRF Metadata Pivot (CTF) agent skill

What the skill makes the agent do

Agent skills are folders of instructions that an AI agent loads when a task matches them. This one is a downstream specialisation for SSRF work. It asks the agent to separate the SSRF source (for example a URL parameter, webhook, image fetcher, importer or proxy endpoint), the forwarding layer, the reachable target, and the downstream service that accepts a credential.

The skill tells the agent to record request method, URL construction, header behaviour, redirects, DNS or host overrides and response shaping before changing anything. It then reduces the path to one chain: SSRF source, internal or metadata target, credential or sensitive response, and accepted replay or API access. The agent is also told to distinguish reachability from real privilege, since a reachable metadata endpoint alone does not prove access.

Requirements before you install

The skill is not meant to run alone. Its own file says it should only be used after the parent skill, ctf-sandbox-orchestrator, is installed, active and has set up the sandbox assumptions. If that has not happened, the skill tells the agent to return to the parent first.

You also need a Claude or SKILL.md-compatible agent environment. The skill folder includes the reference file references/ssrf-metadata-pivot.md, which holds the checklists and evidence format, so keep the folder intact. The skill makes network use part of its workflow, and it does not run scripts.

• Parent skill ctf-sandbox-orchestrator installed and active
• A Claude or SKILL.md-compatible agent environment
• The full skill folder, including references/ssrf-metadata-pivot.md
• Network access is used by the workflow; the skill itself ships no scripts

Install the skill from the ZIP

Download the ZIP for this skill from the page where you found this guide. Unzip it, then place the skill folder in one of two locations. For a personal install across your projects, use the skills folder in your home directory. For a single project, put it in a .claude/skills/ folder inside that project.

If you use the Claude apps instead, you can upload the skill under Settings, then Capabilities, then Skills. Install the parent ctf-sandbox-orchestrator skill the same way before you use this one.

• Personal install: unzip into your home directory's skills folder
• Project install: unzip into the project's .claude/skills/ folder
• Claude apps: Settings → Capabilities → Skills, then upload

Trigger the skill with natural requests

You do not need special syntax. The skill's description lists the kinds of requests it matches: tracing SSRF sources, internal hosts, metadata endpoints, link-local tokens, service-account credentials, or explaining how a server-side fetch becomes accepted access. Start by setting up the parent skill's sandbox assumptions, then ask in those terms.

The skill's instructions name the parent explicitly, so mentioning ctf-sandbox-orchestrator in your request helps the agent route correctly. The agent replies in Simplified Chinese by default unless you explicitly ask for English.

• Trace where the URL parameter on the image importer is fetched from in this CTF lab.
• Check whether the metadata endpoint is reachable through the webhook callback, and what token fields come back.
• Show which downstream service accepts the link-local token, and reproduce the smallest working path.
• Explain how this server-side fetch edge turns into accepted access, in English please.

Follow the three-part workflow

The skill works in three stages. First it maps SSRF reachability: source primitive, scheme filtering, host allowlists, redirects, DNS resolution, path rewrites and header injection. Second it traces the metadata and credential pivot: which metadata, internal control or workload identity services respond, the token's scope, service account and expiry, and where the token is accepted. Third it compresses the result into the decisive chain and states which edge is decisive, such as a parser bypass, allowlist bypass, redirect abuse, header confusion or metadata trust.

The reference file adds a five-step chain to reconstruct: confirm the fetch primitive, confirm the internal or metadata endpoint, extract the credential, confirm a downstream service accepts it, then reproduce the capability. The skill's final output is a single minimal replay path plus the evidence for source, pivot and acceptance.

• Source side: endpoint, parameter, URL construction and normalisation rules
• Pivot side: target host, metadata path, token fields, scope and expiry
• Acceptance side: target service, replay method and resulting privilege

Safety: scope, authorisation and network use

This skill is built around reaching internal hosts and extracting credentials, so it is for authorised lab work only. The source says it is not for testing real production systems or third-party servers without written authorisation. Use it on deliberately vulnerable sandboxes, CTF challenges and training environments you are permitted to attack.

The skill uses the network as part of its method, and it does not run scripts. Keep your lab network isolated from production and from anything you do not own or have written permission to test. If the task turns into mostly cloud identity policy analysis, the skill says to hand off to a tighter cloud metadata skill instead.

• Do not point it at production or third-party systems without written authorisation
• Keep lab traffic inside the sandbox you are permitted to use
• Expect the agent to hand off cloud identity policy questions to a narrower skill

Tips for better results

Give the agent the sandbox context up front: what the lab is, which parts are in scope and what the flag or goal looks like. The skill's own checklist warns against treating metadata reachability as equivalent to privilege, so ask for the acceptance proof explicitly. Also ask the agent to report redirects and host normalisation, since the checklist lists ignoring them as a common mistake.

Ask for the final accepted-access step and the write-up. The skill's pitfalls include skipping that step, so a clear request for the replay and report keeps the result complete.

• State the scope and goal of the lab at the start
• Ask explicitly for proof that the downstream service accepted the credential
• Ask for redirect and header behaviour to be recorded, not assumed
• Ask for the final replay path and report