competition-mailbox-abuse

1# Competition Mailbox Abuse
2 
3Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4 
5Use this skill when the decisive path runs through mailbox behavior, consent flow, or message-routing effects rather than generic AD evidence alone.
6 
7Reply in Simplified Chinese unless the user explicitly requests English.
8 
9## Quick Start
10 
111. Decide whether the active path is phishing-to-consent, token-to-mailbox, rule-based persistence, or transport-level mail rerouting.
122. Keep mailbox evidence, identity evidence, and message-trace evidence tied to the same user, mailbox, token, or message ID.
133. Separate possession of a token or delegate edge from the actual mailbox effect it enables.
144. Record forwarding targets, rule predicates, consent scopes, shared mailbox edges, and resulting mail flow in compact blocks.
155. Reproduce the smallest mail effect that proves persistence, exfiltration, or privilege.
16 
17## Workflow
18 
19### 1. Map The Mail Trust Path
20 
21- Identify the principal, mailbox, token or session, consent grant, delegate edge, shared mailbox relationship, or app registration involved.
22- Record consent scopes, mailbox permissions, rule ownership, transport actions, and message-trace identifiers.
23- Distinguish client-visible symptoms from server-side mailbox or transport state.
24…