What problem does it solve? Realtime behavior in CTF and sandbox challenges is often hidden in WebSocket or SSE traffic rather than plain HTTP requests, making it hard to identify which handshake parameters, auth material, or frames actually drive the decisive state change. ## Core Features & Use Cases - Handshake Mapping: Records upgrade requests, headers, cookies, tokens, query params, origin checks, and negotiated subprotocols for WebSocket and SSE endpoints. - Frame Flow Decoding: Separates subscribe, ack, heartbeat, server push, reconnect, and terminal frames while recovering message schemas and channel identities. - Decisive Path Reduction: Compresses findings into the smallest replayable handshake-plus-frame sequence that proves the state change. - Use Case: During a CTF web challenge, you suspect a flag unlock is triggered by a realtime subscription. Use this Skill to map the handshake, isolate the auth frame, and reproduce the minimal frame sequence that unlocks the route. ## Quick Start Ask the agent to inspect the WebSocket handshake and decode the frame flow that changes application state, after the ctf-sandbox-orchestrator has established sandbox assumptions.
