Name: competition-supply-chain
Author: zhaoxuya520

Imported from zhaoxuya520/reverse-skill (CTF-Sandbox-Orchestrator/competition-supply-chain/SKILL.md). Install upstream with npx skills add zhaoxuya520/reverse-skill --skill competition-supply-chain. Copyright stays with the author.

Competition Supply Chain

Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.

Use this skill when the challenge is really about provenance, dependency drift, build output, release flow, or what runtime artifact actually got shipped.

Reply in Simplified Chinese unless the user explicitly requests English.

Quick Start

Split the problem into source, dependency resolution, build, packaging, publish, and runtime consumption.
Decide where the first divergence occurs between intended artifact and runtime artifact.
Keep provenance as a compact chain, not a scattered set of observations.
Reproduce the smallest possible build or package path that still shows the issue.
Separate checked-in intent from what the pipeline actually emitted.

Workflow

1. Trace Provenance End-To-End

Map source checkout, lockfiles, dependency fetch, pre/post-install steps, build scripts, packaging, publish target, and runtime consumer.
Compare declared version, resolved version, and shipped artifact.
Note registry, cache, mirror, or CI environment differences.

2. Reconcile Build-Time And Runtime

Compare manifests with image layers, mounted secrets, generated files, and runtime hooks.
Identify whether the decisive mutation happens in dependency install, build step, publish step, or runtime bootstrap.

3. Report The Break Point

State the earliest point where provenance diverges.
Keep evidence in one short chain from source to runtime consumer.

Read This Reference

Load references/supply-chain.md for the provenance checklist, evidence packaging, and common pipeline failure modes.

What To Preserve

Declared dependency, resolved dependency, and runtime artifact versions
CI step names, registry pulls, artifact hashes, and image or package layers
The runtime consumer that actually accepts or executes the artifact

Install competition-supply-chain and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "zhaoxuya520-reverse-skill-competition-supply-chain", "kind": "skill", "name": "competition-supply-chain", "description": "Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for CI/CD, registry, dependency drift, artifact provenance, image build, release pipeline, and runtime consumer challenges. Use when the user asks to trace dependency drift, registry pulls, malicious packages, build or release tampering, CI execution, artifact signing, or which shipped artifact the runtime actually consumes. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.", "publisher": "zhaoxuya520", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "skills-sh" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for CI/CD, registry, dependency drift, artifact provenance, image build, release pipeline, and runtime consumer challenges. Use when the user asks to trace dependency drift, registry pulls, malicious packages, build or release tampering, CI execution, artifact signing, or which shipped artifact the runtime actually consumes. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here." ], "primary": false, "metadata": { "source": { "provider": "skills.sh", "repository": "https://github.com/zhaoxuya520/reverse-skill", "path": "CTF-Sandbox-Orchestrator/competition-supply-chain/SKILL.md", "ref": "HEAD", "url": "https://github.com/zhaoxuya520/reverse-skill/blob/HEAD/CTF-Sandbox-Orchestrator/competition-supply-chain/SKILL.md", "key": "zhaoxuya520/reverse-skill/CTF-Sandbox-Orchestrator/competition-supply-chain/SKILL.md" } }, "instructions": "# Competition Supply Chain\n\nUse this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.\n\nUse this skill when the challenge is really about provenance, dependency drift, build output, release flow, or what runtime artifact actually got shipped.\n\nReply in Simplified Chinese unless the user explicitly requests English.\n\n## Quick Start\n\n1. Split the problem into source, dependency resolution, build, p", "cost": { "context_tokens": 521 } }

competition-supply-chain

About