Challenge Maintenance
Documentschallenge-maintenanceChallenge Maintenance is an Agent Skill for documents published in the juice-shop/pwning-juice-shop repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Guidelines for adding, updating, and verifying OWASP Juice Shop challenge documentation based on challenges.yml.
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/juice-shop/pwning-juice-shop/blob/HEAD/.ai/challenge-maintenance/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/challenge-maintenance, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
Challenge Maintenance Skill
Use this skill when you need to add new challenges, update existing ones, or verify that the documentation is in sync with the source of truth: docs/modules/ROOT/assets/data/challenges.yml.
Core Principles
- Source of Truth: Always use
challenges.ymlas the authoritative source for challenge names, descriptions, categories, difficulties, and hints. - Alphabetical Order: Maintain strict alphabetical order by challenge name in all summary tables (README.adoc, category files).
- Consistency: Ensure hints and solution placeholders exist for every challenge.
- Cross-Referencing: Use consistent anchor names derived from section headers.
- Quality Descriptions: Write unique prose for challenge descriptions. Do not copy the description from
challenges.yml1:1, and do not just concatenate hints.
Adding a New Challenge
When a new challenge is added to challenges.yml, follow these steps:
1. Identify the Target Files
- Category File: Locate the
.adocfile indocs/modules/ROOT/pages/part2/corresponding to the challenge's category (e.g.,injection.adocfor 'Injection'). - Hints File: Hint partials are managed by the
partialize_hints.ymlpipeline. AI agents must not create or modify them. - Master List: Update
docs/modules/ROOT/pages/part2/README.adoc. - Solutions: Update
docs/modules/ROOT/pages/appendix/solutions.adoc.
2. Update the Category File
- Add a row to the "Challenges covered in this chapter" table.
- Add a detailed section:
[[_{anchor_name}]] == {Section Header} {Description} include::../../partials/hints/{challengeKey}.adoc[] - {Description}: A paragraph introducing the challenge. This should be original text, not a verbatim copy of the YAML description or a mere mash-up of the hints.
- Section Header: Usually the first sentence of the description or a concise instruction.
- Anchor Name: Lowercase version of the Section Header with spaces replaced by underscores and special characters removed.
3. Hint Partials
- Hint partials in
docs/modules/ROOT/partials/hints/are managed exclusively by thepartialize_hints.ymlpipeline. - AI agents MUST NOT create or modify these files.
- Exception: The 'Score Board' challenge (
scoreBoardChallenge) does not have hints and must NEVER have a hint partial file.
4. Update the README.adoc
- Add the challenge to the "Challenge hunting" table in alphabetical order.
- Add the challenge to the "Challenge hunting (CTF mapping)" table in alphabetical order.
- Use
xreflinks to the category file and the solution section.
5. Update the Solutions Appendix
- Locate the section for the challenge's difficulty (e.g.,
== ⭐⭐⭐ Challenges). - Add a subsection
=== {Section Header}. - Add the placeholder:
// TODO Add solution for {challengeKey}. - Ensure subsections are sorted alphabetically within the difficulty level.
6. Update Tags (if necessary)
- If the challenge introduces a new tag not yet documented, update
docs/modules/ROOT/pages/part1/challenges.adocin alphabetical order.
Verification & Cleanup
When asked to verify if the documentation is up to date:
- Gaps: Compare
challenges.ymlwithREADME.adoc. Identify any missing challenges. - Leftovers: Identify sections or files referring to challenges no longer in
challenges.yml. - Desyncs: Check if descriptions or hints in the docs match the latest YAML content.
- Broken Links: Verify that all
xrefand<<anchor>>links point to existing targets.
See checklists/challenge_verification.md for a detailed verification procedure.