Skip to content
Get packs

Competition Mailbox Abuse

Guides an agent through tracing mailbox rules, OAuth consent and forwarding abuse in a CTF sandbox

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
3 files

What it does

This is a specialist add-on for a CTF (capture-the-flag) training sandbox. Once a parent skill has set up the sandbox, it tells the AI agent how to trace how email artifacts such as OAuth consent grants, inbox or forwarding rules, transport rules and shared mailbox access can turn into persistence, data exfiltration or privilege. The agent is told to correlate logs and message IDs and to write up the smallest replayable chain of events. It is documentation and workflow guidance, not a tool that changes mail systems by itself.

Great for

  • Security students or competitors practising mail-based attack paths in an authorised CTF lab
  • Blue-team analysts learning how to correlate consent logs, inbox rules and message traces during an investigation
  • Instructors building enterprise mail-abuse training exercises

Skip it if

  • Attacking real mailboxes or organisations without written authorisation, since the instructions focus on reproducing abuse effects and could be misused
  • Non-security users wanting general email help, because it only applies inside the parent sandbox workflow
  • Anyone expecting it to run scans or send mail itself, since the files contain no executable scripts

Try asking

  • “Trace the OAuth consent grants and token claims behind a suspicious app in our CTF lab tenant”
  • “Map which inbox rule is silently forwarding messages and list the forwarding target and predicates”
  • “Correlate message-trace IDs with sign-in logs to show how a phishing lure led to mailbox access”
Step-by-step guide: how to use Competition Mailbox AbuseInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    competition-mailbox-abuse.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip competition-mailbox-abuse.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip competition-mailbox-abuse.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only invoke it after ctf-sandbox-orchestrator has established sandbox assumptions, as the skill itself requires this
  • Provide message IDs, consent scopes and timestamps together so the agent can align evidence across logs
  • Note that the skill asks the agent to reply in Simplified Chinese unless English is requested

What's inside

  • agents/openai.yaml
  • references/mailbox-abuse.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.