{"slug":"elementalsouls-hunt-http-smuggling","source_name":"elementalsouls/hunt-http-smuggling","name":"Elementalsouls/Hunt HTTP Smuggling","description":"Hunt HTTP request smuggling (CL.TE, TE.CL, H2.CL, H2.TE). Cause: front-end proxy and back-end server disagree on where one request ends and the next begins (Content-Length vs Transfer-Encoding header parsing inconsistency). CL.TE: front-end uses CL, back uses TE → smuggle by sending TE: chunked but with body that fits CL count. TE.CL: opposite. H2.CL: HTTP/2 downgrade, smuggle CL into HTTP/1.1 back-end. Detection tools: Burp HTTP Request Smuggler extension, smuggler.py, h2csmuggler. Confirm: tim","version":1,"lift":{"pass_rate_delta_pts":13.64,"pass_rate_pct":90.9,"total_cases":22,"passed_cases":20,"tokens_delta_pct":54.2,"turns_delta_pct":0,"verdict":"mixed","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-08-09T13:49:39.941214+00:00"},"skill_score":0.9091,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":13.64,"with_pass_pct":90.9,"without_pass_pct":77.3,"tokens_delta_pct":54.2,"turns_delta_pct":0,"total_cases":22,"cases_aggregated":22,"verdict":"mixed","never_hurt":true,"completed_at":"2026-08-09T13:49:39.941214+00:00","run_id":"df5c9bf0-e0b5-44bb-a3ae-053ebb0baa66","version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":"safe","content_status":"clean","indexable":true},"license":"NOASSERTION","install_count":0,"manifest_hash":"0fe35579bf77d0d01f2db9cf52d77ed30e9796c1a836d9412b2eab5a0a2a3bc5","raw_url":"https://app.decimal.ai/s/elementalsouls-hunt-http-smuggling/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/elementalsouls-hunt-http-smuggling"}