Competition OAuth OIDC Chain

Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.

Use this skill when the hard part is proving how an OAuth or OIDC flow is shaped, exchanged, and ultimately accepted.

Reply in Simplified Chinese unless the user explicitly requests English.

Quick Start

1. Map the auth chain in order: entry route, redirect, authorize request, callback, token exchange, refresh, and final accepting service.
2. Record scopes, state, nonce, PKCE material, redirect URIs, and claim-bearing tokens before mutating anything.
3. Separate token possession from actual identity acceptance.
4. Keep browser-visible redirects and backend-visible token exchange in one compact chain.
5. Reproduce the smallest redirect-to-acceptance flow that proves the decisive identity edge.

Workflow

1. Map The Redirect And Token Path