How do I install the Competition Ssrf Metadata Pivot skill?

Run npx skillmds@latest add gabrielmoreira/competition-ssrf-metadata-pivot in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Competition Ssrf Metadata Pivot safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Competition Ssrf Metadata Pivot?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Competition Ssrf Metadata Pivot free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Competition Ssrf Metadata Pivot?

gabrielmoreira (@gabrielmoreira) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Competition Ssrf Metadata Pivot by gabrielmoreira

Name: Competition Ssrf Metadata Pivot
Rating: 4.2 (5 reviews)
Author: gabrielmoreira

Competition Ssrf Metadata Pivot

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for SSRF reachability, internal route probing, metadata-service access, credential pivoting, and token-to-accepted-privilege chains. Use when the user asks to trace SSRF sources, internal hosts, metadata endpoints, link-local tokens, service-account credentials, or explain how a server-side fetch edge turns into accepted access. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

gabrielmoreira Updated Sep 9, 2026 17 repo stars

File contents

Competition SSRF Metadata Pivot

Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.

Use this skill when the decisive path runs through server-side request capability, internal service reachability, or metadata-derived credentials.

Reply in Simplified Chinese unless the user explicitly requests English.

Quick Start

Separate the SSRF source, forwarding layer, reachable target, and accepted downstream credential edge.
Record request method, URL construction, header behavior, redirects, DNS or host overrides, and response shaping before mutation.
Map internal host, metadata endpoint, token extraction, and accepting service as one chain.
Distinguish read-only reachability from credential-bearing access.
Reproduce the smallest SSRF-to-accepted-access path.

Workflow

1. Map SSRF Reachability

Record source primitive: URL parameter, webhook, image fetcher, importer, proxy endpoint, or backend callback.
Note normalization steps: scheme filtering, host allowlists, redirects, DNS resolution, path rewrite, and header injection.
Keep target host, protocol, and response behavior tied to the exact SSRF source.

2. Trace Metadata And Credential Pivot

Show whether metadata endpoints, internal control APIs, or workload identity services are reachable.
Record token fields, role scope, service account, expiration, and where the token is accepted.
Distinguish credential extraction success from accepted privilege at a downstream service.

3. Reduce To Decisive SSRF Chain

Compress to: SSRF source -> internal or metadata target -> credential or sensitive response -> accepted replay or API access.
State whether the decisive edge is parser bypass, allowlist bypass, redirect abuse, header confusion, or metadata trust.
If the task becomes mostly cloud identity policy analysis, hand off to the tighter cloud metadata skill.

Read This Reference

Load references/ssrf-metadata-pivot.md for SSRF checklists, metadata pivots, and evidence packaging.

What To Preserve

SSRF source point, URL construction rules, reachable hosts, and response deltas
Extracted token or credential fields, scope, and accepting service
One minimal SSRF-to-accepted-access replay path

---name: competition-ssrf-metadata-pivotdescription: Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for SSRF reachability, internal route probing, metadata-service access, credential pivoting, and token-to-accepted-privilege chains. Use when the user asks to trace SSRF sources, internal hosts, metadata endpoints, link-local tokens, service-account credentials, or explain how a server-side fetch edge turns into accepted access. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.--- # Competition SSRF Metadata Pivot Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first. Use this skill when the decisive path runs through server-side request capability, internal service reachability, or metadata-derived credentials. Reply in Simplified Chinese unless the user explicitly requests English. ## Quick Start 1. Separate the SSRF source, forwarding layer, reachable target, and accepted downstream credential edge. 2. Record request method, URL construction, header behavior, redirects, DNS or host overrides, and response shaping before mutation. 3. Map internal host, metadata endpoint, token extraction, and accepting service as one chain. 4. Distinguish read-only reachability from credential-bearing access. 5. Reproduce the smallest SSRF-to-accepted-access path. ## Workflow ### 1. Map SSRF Reachability - Record source primitive: URL parameter, webhook, image fetcher, importer, proxy endpoint, or backend callback. - Note normalization steps: scheme filtering, host allowlists, redirects, DNS resolution, path rewrite, and header injection. - Keep target host, protocol, and response behavior tied to the exact SSRF source. ### 2. Trace Metadata And Credential Pivot - Show whether metadata endpoints, internal control APIs, or workload identity services are reachable. - Record token fields, role scope, service account, expiration, and where the token is accepted. - Distinguish credential extraction success from accepted privilege at a downstream service. ### 3. Reduce To Decisive SSRF Chain - Compress to: SSRF source -> internal or metadata target -> credential or sensitive response -> accepted replay or API access. - State whether the decisive edge is parser bypass, allowlist bypass, redirect abuse, header confusion, or metadata trust. - If the task becomes mostly cloud identity policy analysis, hand off to the tighter cloud metadata skill. ## Read This Reference - Load `references/ssrf-metadata-pivot.md` for SSRF checklists, metadata pivots, and evidence packaging. ## What To Preserve - SSRF source point, URL construction rules, reachable hosts, and response deltas - Extracted token or credential fields, scope, and accepting service - One minimal SSRF-to-accepted-access replay path

Frequently asked questions