What problem does it solve? CTF challenges and API audits often hide the decisive behavior in mismatches between declared contracts (GraphQL schemas, persisted queries, RPC manifests, OpenAPI specs) and what live handlers actually accept. This Skill provides a structured workflow to capture real requests, compare them against declared contracts, and isolate hidden, stale, or privileged operations. ## Core Features & Use Cases - Contract Surface Mapping: Record schemas, introspection output, persisted query ids, RPC manifests, generated clients, and OpenAPI documents with version markers. - Live Handler Verification: Capture real request/response pairs including operation names, variables, headers, and auth context to prove handler-side behavior. - Drift Reduction: Compress findings into the smallest contract-to-handler mismatch that proves the decisive branch, such as a hidden mutation or undocumented RPC method. - Use Case: During a CTF sandbox challenge, you suspect a GraphQL endpoint accepts operations not present in the schema. Use this Skill to diff the declared schema against captured live requests and reproduce the hidden operation that yields the flag. ## Quick Start After $ctf-sandbox-orchestrator is active, ask it to compare the declared GraphQL schema and generated client against captured live requests to find the hidden operation that produces the decisive behavior.
