Screened · automated checks passed
hunt-http-smuggling
What the author says it does
Hunt HTTP request smuggling (CL.TE, TE.CL, H2.CL, H2.TE). Cause: front-end proxy and back-end server disagree on where one request ends and the next begins (Content-Length vs Transfer-Encoding header parsing inconsistency). CL.TE: front-end uses CL, back uses TE → smuggle by sending TE: chunked but with body that fits CL count. TE.CL: opposite. H2.CL: HTTP/2 downgrade, smuggle CL into HTTP/1.1 back-end. Detection tools: Burp HTTP Request Smuggler extension, smuggler.py, h2csmuggler. Confirm: time-delay technique (smuggled GET with 30s timeout) — if front-end returns slow on next victim request, smuggling works. Validate: cache poisoning chain (smuggle request that gets cached for victim), credential theft (smuggle X-Forwarded-For override that captures next user's cookies), bypass auth (smuggled internal-path request). Real paid examples from major CDN deployments. Use when hunting H1 paid programs running CDN+origin stacks, when targeting load balancer / WAF bypass.
Quoted from the skill's own SKILL.md trigger description — this is what tells
Claude when to activate it. Not yet verified by us.
Automated screening
100/100 validator score
Scored by the same rules as our free SKILL.md validator: trigger description quality, body substance, structure. Automated — a human bench test is the next step in the pipeline.
Install (unverified — review first)
git clone https://github.com/elementalsouls/Claude-BugHunter # skill lives at: skills/hunt-http-smuggling/SKILL.md
SkillProof status
This skill is in our test queue. We install every skill in a clean environment, run a trigger battery and score output against a baseline before it earns a catalog page — the full protocol is public. Until then, treat it like any unreviewed dependency: read the SKILL.md and any scripts before installing.
Already tested in Token Efficiency
- Kill Dev Process Classifies and safely kills orphaned dev servers/browsers with a hard exclusion list for databases and the IDE.
- Clean Cache Tiered, confirmation-gated cache cleanup for Flutter/Android/iOS/Node workspaces — verified not to touch lockfiles or source.
- Agent Prompt Engineering A five-part checklist (role, paths, deliverables, constraints, comms) for writing sub-agent prompts that need zero follow-up.
- Tidy Skill Read-only hygiene audits that stop agents littering repos with plan.md/todo.md junk.