competition-cloud-metadata-path

1# Competition Cloud Metadata Path
2 
3Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4 
5Use this skill when the decisive edge is not just reaching metadata, but proving how metadata-derived identity becomes accepted privilege.
6 
7Reply in Simplified Chinese unless the user explicitly requests English.
8 
9## Quick Start
10 
111. Identify which metadata surface is active: instance metadata, workload identity, node identity, task role, or platform-specific token endpoint.
122. Record the exact reachability path: local process, pod, container, proxy, SSRF surface, or host route.
133. Separate metadata reachability from credential issuance and from downstream privilege acceptance.
144. Keep token format, role identity, scope, and accepting API in compact evidence blocks.
155. Reproduce the smallest metadata-to-accepted-privilege path that proves the challenge edge.
16 
17## Workflow
18 
19### 1. Map Metadata Reachability
20 
21- Record the metadata endpoint, required headers, hop limits, session tokens, workload selectors, or path prefixes.
22- Note whether access comes from direct local calls, pod networking, SSRF, sidecar, or host-level routing.
23- Keep the reaching surface and the metadata endpoint in one chain.
24 
25### 2. Prove Credential Or Identity Issuance
26…