Guide · Agent skill
How to use the HTTP Request Smuggling agent skill (offensive-request-smuggling)
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains how to install and use the offensive-request-smuggling skill, a methodology checklist for HTTP request smuggling that an AI agent can load and follow. It is written for penetration testers, bug bounty hunters and security engineers who already understand HTTP parsing and proxies. By the end you will know what the skill changes about the agent's behaviour, how to add it, how to ask for it with natural requests, and what safety limits to respect.
HTTP Request Smuggling ChecklistSnailSploit/Claude-Red · MIT Download the skill Quick start
- 1Download the ZIP. Get the offensive-request-smuggling ZIP from this skill's page on the directory.
- 2Install the folder. Unzip it into ~/.claude/skills/ for all projects, or into a project's .claude/skills/ for one project.
- 3Or upload in the Claude apps. Open Settings, go to Capabilities, then Skills, and upload the skill.
- 4Confirm authorisation and scope. Tell the agent the target you are authorised to test and whether it is a lab or your own system.
- 5Ask for a specific task. Use a trigger phrase such as CL.TE detection or HTTP/2 downgrade in a natural request.
- 6Run the tests yourself. Send the raw requests through Burp Suite or a similar tool, with Update Content-Length unchecked where the examples say so.
- 7Report findings and next steps. Share the responses with the agent so it can suggest the next checklist items.
What is an agent skill, and what does this one do?
An agent skill is a folder containing a SKILL.md file with instructions that an AI agent loads when a task matches the skill. This one is the HTTP Request Smuggling checklist, folder name offensive-request-smuggling, and its only listed file is SKILL.md.
Once active, the skill tells the agent to load the full methodology as its operational checklist, follow the steps in order unless you say otherwise, track which items are complete, and suggest next steps based on findings. The methodology covers how front-end and back-end servers can disagree about where one HTTP request ends and the next begins, including CL.TE, TE.CL and TE.TE detection, HTTP/2 downgrade variants, WAF bypass ideas and cache poisoning.
Install the skill with a ZIP file or the Claude apps
Download the ZIP from the skill's page on this directory, then choose one of the following methods.
For Claude Code, unzip the folder into your personal skills directory ~/.claude/skills/, or into a project's .claude/skills/ directory if you want it limited to one project. The result should be a folder named offensive-request-smuggling containing SKILL.md.
In the Claude apps, open Settings, go to Capabilities, then Skills, and upload the skill from the ZIP.
- Personal: ~/.claude/skills/offensive-request-smuggling/
- Project only: .claude/skills/offensive-request-smuggling/ inside your project
Trigger the skill with natural requests
The skill loads when your conversation involves its trigger phrases. These include request smuggling, HTTP smuggling, CL.TE, TE.CL, TE.TE, HTTP/2 smuggling, cache poisoning, WAF bypass, differential response, smuggling detection and proxy desync. You do not need to type these exactly, but using them makes activation more reliable.
State your authorisation and target context in the same message. The skill expects you to be testing a system you are authorised to assess, and it considers applicability to the current target.
- Review my load balancer config for CL.TE and TE.CL desync risks. I have written permission to test staging.example.internal.
- I'm working through a Burp Suite lab on HTTP/2 downgrade smuggling. Walk me through the detection steps in order.
- We have a CDN in front of our app. Which HTTP/2 desync variants should I check, and what should I track in my notes?
- My smuggled request got a 400 response. What should I try next according to the checklist?
Run the detection tests in the right order
The methodology's initial assessment tests standard CL.TE and TE.CL payloads and checks header obfuscation and timing. Confirmation testing sends a smuggled request that should trigger a distinct response, tests queue poisoning and looks for status code anomalies. Targeted testing covers HTTP/2 downgrade scenarios, header oversizing and method handling.
The examples are raw HTTP requests, not scripts. For the TE.CL confirmation example, the source says to make sure Burp's Update Content-Length setting is unchecked, because otherwise Burp rewrites the header you are testing.
- Time delay test: send the CL.TE or TE.CL request, then send a normal request and watch for a delay.
- Twice-send confirmation: the second response shows the effect of a smuggled method such as GPOST.
- Obfuscation: variants such as Transfer-encoding: cow or Transfer-Encoding: xchunked test whether one server ignores a malformed header.
POST / HTTP/1.1
Host: your-lab-id.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-length: 4
Transfer-Encoding: chunked
Transfer-encoding: cow
5c
GPOST / HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 15
x=1
0Safety, scope and what the skill needs
The skill runs no scripts and makes no network calls of its own. It is a text checklist, so any requests are sent by you, through a tool such as Burp Suite. The examples mention Burp's Update Content-Length setting, so you need an HTTP testing tool to act on them.
Sending these crafted requests can disrupt live services and may be illegal without permission. Only use it against a target you own, an intentionally vulnerable lab, or a system you have written authorisation to test. The skill is a methodology for authorised testing, not a defence or secure coding guide.
- Requires: an HTTP testing tool such as Burp Suite, written authorisation for the target, and access to a lab or a system you own.
- Runs scripts: no. Uses network: no.
- Do not point the checklist at production systems you have not been cleared to test.
What people use it for
- Working through a Burp Suite lab on CL.TE and TE.CL desync to learn how the two servers disagree.
- Reviewing a reverse proxy or load balancer configuration for the smuggling variants it should be checked against.
- Planning an authorised bug bounty test that covers HTTP/2 downgrade and header obfuscation.
- Keeping a structured checklist of which smuggling techniques have been tried and which remain.
Frequently asked questions
Is the offensive-request-smuggling skill free?
The skill is published under the MIT licence, as listed on this page. Check the licence file in the source repository for the full terms before you reuse it.
What do I need before using this skill?
You need an HTTP testing tool such as Burp Suite, written authorisation to test the target, and access to an intentionally vulnerable lab or a system you own. The skill itself runs no scripts and uses no network access.
Where do I install an agent skill?
For Claude Code, unzip the folder into ~/.claude/skills/ or a project's .claude/skills/ directory. In the Claude apps, go to Settings, then Capabilities, then Skills, and upload it.
Will the skill run the attacks for me?
No. The skill contains a methodology and example raw requests. You send the requests yourself with a tool such as Burp Suite, then share the results so the agent can suggest next steps.
Why does the example ask me to uncheck Update Content-Length?
The TE.CL and TE.TE examples depend on a specific Content-Length value. The source says Burp's Update Content-Length setting should be unchecked, so the tool does not rewrite the header you are testing.
Who should not use this skill?
Anyone without permission to test the target, developers wanting a secure coding or web development guide, and non-security users. The content assumes familiarity with HTTP parsing, proxies and Burp Suite-style tools.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a penetration tester, bug bounty hunter, security engineer or student with written authorisation or a lab to practise on, and you already understand HTTP parsing. It gives a structured, ordered checklist of smuggling variants and next steps. Pick something else if you need defensive guidance, a general web development guide, or a tool that runs tests automatically.
Download the skill