Skip to content
Get packs

Competition OAuth/OIDC Chain Tracer

Traces OAuth/OIDC login redirects and token flows in CTF sandbox challenges

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
3 files

What it does

This is a specialist instruction set for an AI agent working on capture-the-flag style security exercises about login systems (OAuth and OpenID Connect). When activated, the agent maps each step of a login flow: the starting request, redirects, callback parameters, token exchange, token refresh, and which service finally accepts the identity. It is meant to run only after a parent skill, ctf-sandbox-orchestrator, has set up the sandbox context, and it tells the agent to preserve evidence and keep one minimal replayable flow. The skill's own text describes it as an internal downstream skill.

Great for

  • Students or competitors working on OAuth/OIDC challenges in a CTF sandbox
  • Security practitioners studying how redirect, state, nonce and PKCE handling affects login acceptance in a lab
  • Users already working through the ctf-sandbox-orchestrator skill who need this specific auth-chain step

Skip it if

  • Testing real production login systems or third-party services without authorization, since the skill is built for sandboxed exercises and probing live accounts could be illegal
  • Developers who simply want to build a secure login; it focuses on how flows are exploited or traced, not on hardening guidance
  • Users who have not installed or activated the parent ctf-sandbox-orchestrator skill, because the skill says it should not be used on its own

Try asking

  • “Trace the redirect and callback parameters in this CTF sandbox OAuth login and show where the token is accepted”
  • “Check how state and nonce are handled in this OIDC challenge and list the decisive edge”
  • “Explain how the refresh token flow in this sandbox turns into an app session with elevated privilege”
Step-by-step guide: how to use Competition OAuth/OIDC Chain TracerInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    competition-oauth-oidc-chain.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip competition-oauth-oidc-chain.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip competition-oauth-oidc-chain.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Install and activate ctf-sandbox-orchestrator first; this skill will redirect the agent back to it otherwise
  • Only point it at lab or competition targets you are authorized to test, and keep the sandbox isolated
  • Ask for a short chain summary plus one minimal reproduction, as the skill is designed to produce that format; replies are in Simplified Chinese by default unless you request English

What's inside

  • agents/openai.yaml
  • references/oauth-oidc-chain.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.