competition-web-runtime

1# Competition Web Runtime
2 
3Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4 
5Use this skill when the active challenge is primarily about web behavior, browser state, server routing, API order, or worker-backed application flow.
6 
7Reply in Simplified Chinese unless the user explicitly requests English.
8 
9## Quick Start
10 
111. Assume the presented hosts, domains, and routes belong to the sandbox.
122. Inspect entry HTML, boot scripts, runtime config, and route registration before trusting the visible UI.
133. Capture one real request flow end-to-end before making broad claims from source.
144. Check browser persistence and backend state together.
155. Re-run the smallest flow with one variable changed.
16 
17## Workflow
18 
19### 1. Map The Active Runtime
20 
21- Identify active hosts, paths, proxies, containers, and workers.
22- Inspect cookies, localStorage, sessionStorage, IndexedDB, Cache Storage, and service workers.
23- Record route names, feature flags, storage keys, queue names, and worker names that actually appear in the active flow.
24 
25### 2. Capture The Real Request Order
26 
27- Record exact host, path, query, headers, cookies, and body for decisive requests.
28- Compare successful and failing paths.
29- Treat UI gating as a hint, not proof of backend enforcement.
30…