Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →snailsploit/skill-http-request-smuggling
- **Skill Name**: request-smuggling
Passed 19 of 22 test cases with the skill, and 16 of 22 without it.
and 2 more in the full report
3 fixed16 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
Which CVE identifier is associated with HTTP/2 to HTTP/1.1 desynchronization in Varnish Cache?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies CVE-2020-11724 as the Varnish HTTP/2 desync CVE | Missed | Passed |
The instructions your model reads when the skill loads.
HTTP request smuggling checklist: CL.TE, TE.CL, TE.TE variants, detection with timing and differential responses, WAF bypass, cache poisoning, credential hijacking, and request smuggling via HTTP/2. Use when testing reverse proxy/load balancer configurations.
Use this skill when the conversation involves any of:
request smuggling, HTTP smuggling, CL.TE, TE.CL, TE.TE, HTTP/2 smuggling, cache poisoning, WAF bypass, differential response, smuggling detection, proxy desync
When this skill is active:
HTTP Request Smuggling is a vulnerability that occurs when front-end and back-end servers interpret HTTP requests differently, leading to a desynchronization in the HTTP request processing chain. This desynchronization allows attackers to "smuggle" requests to the back-end server, potentially bypassing security controls or manipulating how other users' requests are processed.
graph TD
A[Client] -->|HTTP Request| B[Front-end Server]
B -->|Interpreted Request| C[Back-end Server]
B -->|Different Interpretation| D[Desynchronization]
D -->|Smuggled Request| C
D -->|Security Bypass| E[Unauthorized Access]
test cases passed, vs 16 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.