What problem does it solve? CTF challenges and API assessments often hide the decisive behavior in drift between declared contracts (GraphQL schemas, persisted query maps, RPC manifests, OpenAPI specs, generated clients) and what live handlers actually execute. This Skill provides a structured workflow to find hidden, stale, or privileged operations by comparing the declared surface against real request/response behavior. ## Core Features & Use Cases - Contract Surface Mapping: Records schemas, introspection output, persisted query ids, RPC manifests, generated clients, and OpenAPI documents with version markers. - Live Handler Verification: Captures real request/response pairs including operation names, variables, headers, and auth context to prove handler-side hidden branches. - Drift Reduction: Compresses findings into the smallest contract-to-handler mismatch that proves the decisive capability, with evidence packaging guidance. - Use Case: During a CTF sandbox challenge, you suspect a GraphQL endpoint exposes an undocumented mutation. Use this Skill to diff the introspection schema against captured traffic, confirm the hidden operation executes on the live handler, and preserve one accepted and one drifted request pair as evidence. ## Quick Start After the ctf-sandbox-orchestrator has established sandbox assumptions, ask it to compare the declared GraphQL schema and generated client against captured live requests to recover any hidden operations.
