competition-supply-chain
Helps your agent analyze the software supply chain. It allows tracing dependencies, malicious packages, and changes in build and release processes.
What it does
This tool helps understand how a computer program was built and delivered. It tracks every step from the original code to what was actually used, to find issues.
When to use it
- ✓When you suspect a program was tampered with.
- ✓To check if the correct version of a program was used.
- ✓To understand the origin of a bug in a program.
Example of what to ask your AI
“Trace the supply chain for program X and show me where it was modified.”
Want more? Open the sections below.
How to use
The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.
Skill link
Ready-to-paste message
How it works
It compares what should have been built with what was actually built and run. This is done by mapping all steps, like fetching code, installing parts, and final delivery.
Installation
Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.
In the terminal (Claude Code, Codex, Cursor), in your project folder:
npx skills add zhaoxuya520/reverse-skill --skill competition-supply-chainOr download just the file:
curl -L https://raw.githubusercontent.com/zhaoxuya520/reverse-skill/main/CTF-Sandbox-Orchestrator/competition-supply-chain/SKILL.md -o SKILL.mdTechnical content (original SKILL.md)
Original text by the author, straight from GitHub.
Competition Supply Chain
Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.
Use this skill when the challenge is really about provenance, dependency drift, build output, release flow, or what runtime artifact actually got shipped.
Reply in Simplified Chinese unless the user explicitly requests English.
Quick Start
- Split the problem into source, dependency resolution, build, packaging, publish, and runtime consumption.
- Decide where the first divergence occurs between intended artifact and runtime artifact.
- Keep provenance as a compact chain, not a scattered set of observations.
- Reproduce the smallest possible build or package path that still shows the issue.
- Separate checked-in intent from what the pipeline actually emitted.
Workflow
1. Trace Provenance End-To-End
- Map source checkout, lockfiles, dependency fetch, pre/post-install steps, build scripts, packaging, publish target, and runtime consumer.
- Compare declared version, resolved version, and shipped artifact.
- Note registry, cache, mirror, or CI environment differences.
2. Reconcile Build-Time And Runtime
- Compare manifests with image layers, mounted secrets, generated files, and runtime hooks.
- Identify whether the decisive mutation happens in dependency install, build step, publish step, or runtime bootstrap.
3. Report The Break Point
- State the earliest point where provenance diverges.
- Keep evidence in one short chain from source to runtime consumer.
Read This Reference
- Load
references/supply-chain.mdfor the provenance checklist, evidence packaging, and common pipeline failure modes.
What To Preserve
- Declared dependency, resolved dependency, and runtime artifact versions
- CI step names, registry pulls, artifact hashes, and image or package layers
- The runtime consumer that actually accepts or executes the artifact
FAQ
What is 'provenance'?
'Provenance' is like a detailed history showing the origin and all changes of an item, in this case, a computer program.
What is 'dependency drift'?
'Dependency drift' occurs when the parts a program relies on (dependencies) change unexpectedly, potentially causing problems.
Do I need to know how to code to use this?
No, this tool is designed to be used even without programming knowledge. It simplifies the analysis of the software building process.
Details
Original description by the author
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for CI/CD, registry, dependency drift, artifact provenance, image build, release pipeline, and runtime consumer challenges. Use when the user asks to trace dependency drift, registry pulls, malicious packages, build or release tampering, CI execution, artifact signing, or which shipped artifact the runtime actually consum
Popularity
- GitHub stars
- 42k
- Ranking position
- #4739
- License
- MIT
- Updated
- 9/22/2026
Comments
- …
More skills from this repository
competition-ad-certificate-abuse
Helps your agent analyze attacks on digital certificate systems. It investigates how certificates can be misused to gain access.
zhaoxuya520/reverse-skill
competition-agent-cloud
Helps your agent analyze security challenges in AI and cloud systems. It investigates how prompts, tools, and the cloud can be exploited.
zhaoxuya520/reverse-skill
competition-android-hooking
Helps your agent investigate Android applications. It analyzes how apps work internally and how they might be modified or exploited.
zhaoxuya520/reverse-skill
competition-browser-persistence
Helps your agent analyze how websites store information in your browser. It investigates cookies and other data to understand how sessions work.
zhaoxuya520/reverse-skill
Similar skills
dashboard-builder
Helps your agent create useful monitoring dashboards. It turns data into charts that answer important system questions.
affaan-m/ECC
dev-team
Simulates a collaborative development team where different roles respond to a problem together. It's useful for getting multiple perspectives without manually switching agents.
affaan-m/ECC
ecc-council
Has your agent convene a four-voice council for difficult decisions. It's useful when there are multiple good options and debate is needed before choosing.
affaan-m/ECC