Request Normalization Smuggling Specialist
Guides CTF-sandbox analysis of HTTP parser differences and request smuggling routes (Chinese replies by default)
- Repository
- zhaoxuya520/reverse-skill
- Stars
- 43,969
- Licence
- MIT
- Files
- 3 files
What it does
This is a specialist add-on for an AI agent working on capture-the-flag style security exercises inside a sandbox. Once installed, the agent follows a checklist for finding places where a proxy and a backend server read the same HTTP request differently (for example in paths, Host headers, Content-Length or Transfer-Encoding framing), then builds paired test requests to prove the difference and reduce it to a minimal replayable example. It is designed to run only after a parent skill, ctf-sandbox-orchestrator, has set up sandbox assumptions, and it replies in Simplified Chinese unless English is requested.
Great for
- Security students or competitors practicing CTF web challenges on a lab target they are authorized to test
- Security engineers building a controlled test environment to study HTTP request smuggling in their own stack
Skip it if
- Testing live or third-party systems without written authorization, because request smuggling probes can cause real harm and are illegal to aim at systems you do not own or have permission to test
- Users who expect a standalone tool: it depends on a separate parent skill and only gives guidance, not a finished scanner
Try asking
- “Trace where the reverse proxy and the app server disagree about the path in this sandbox challenge”
- “Compare two raw requests that differ only in the Transfer-Encoding header and show which hop routes them differently”
- “Reduce this CL/TE mismatch to one minimal replayable request and list the evidence to keep”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the MIT licence and an attribution note.
competition-request-normalization-smuggling.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip competition-request-normalization-smuggling.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip competition-request-normalization-smuggling.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Make sure the sandbox and the parent orchestrator skill are set up first, or the agent will be told to return to it
- Ask for one difference at a time so the paired requests stay minimal and the evidence is clear
What's inside
- agents/openai.yaml
- references/request-normalization-smuggling.md
- SKILL.md
Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.