Skip to content
Get packs

GraphQL & RPC Drift Analysis

Compares GraphQL/RPC contracts against live handlers to find hidden or drifted operations in CTF sandboxes.

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
3 files

What it does

This skill gives an AI agent a specialized checklist for a security-competition style workflow: it compares declared API contracts (GraphQL schemas, persisted query maps, RPC manifests, generated clients, OpenAPI specs) against how the live server actually behaves, looking for hidden, stale, or privileged operations. The agent is told to record real request and response pairs first, then reduce the mismatch to a minimal, reproducible sequence. It is written as a downstream add-on that only runs after a parent sandbox-orchestrator skill has set the assumptions, and it replies in Simplified Chinese by default.

Great for

  • Participants in capture-the-flag (CTF) style sandbox competitions working on GraphQL or RPC targets
  • Security students learning how contract drift creates exposed endpoints
  • Internal teams already using the ctf-sandbox-orchestrator workflow

Skip it if

  • Testing production or third-party systems without authorization, since the skill is built to probe hidden operations and privileged paths
  • Users who have not set up the parent ctf-sandbox-orchestrator skill, because the file says it should not be used standalone
  • Non-security API work, since its purpose is finding hidden or privileged behavior rather than general development

Try asking

  • “Compare this GraphQL schema and persisted query map against what the live handler accepts in my sandbox”
  • “Find hidden or undocumented RPC methods by matching the client manifest to server behavior”
  • “Explain how a stale generated client produces the decisive privileged branch in this challenge”
Step-by-step guide: how to use GraphQL & RPC Drift AnalysisInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    competition-graphql-rpc-drift.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip competition-graphql-rpc-drift.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip competition-graphql-rpc-drift.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run the parent ctf-sandbox-orchestrator skill first and confirm sandbox scope before using this one.
  • Provide the schema, manifest, or OpenAPI file plus a sample request so the agent can compare them side by side.
  • Keep the work inside an isolated, authorized lab environment; the skill itself does not enforce scope.

What's inside

  • agents/openai.yaml
  • references/graphql-rpc-drift.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.