Guide · Agent skill
How to use the Request Normalization Smuggling agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains how to install and use competition-request-normalization-smuggling, an agent skill for capture-the-flag style web security exercises. It is for security students and engineers who work on HTTP request smuggling in a sandbox they control or are authorized to test. After reading, you will know what the skill makes the agent do, how to install it, how to phrase requests that trigger it, and what safety limits apply.
Request Normalization Smuggling Specialistzhaoxuya520/reverse-skill · MIT Download the skill Quick start
- 1Set up the parent skill. Make sure ctf-sandbox-orchestrator is available and has established your sandbox assumptions. This skill is designed to run only after that.
- 2Download and unzip. Download the ZIP from this page and unzip it. It should contain SKILL.md, references/request-normalization-smuggling.md and agents/openai.yaml.
- 3Place the skill folder. Unzip it into ~/.claude/skills/ for personal use or into .claude/skills/ inside a project. Alternatively, upload it under Settings → Capabilities → Skills in the Claude apps.
- 4Prepare your lab target. Confirm the sandboxed target is one you are authorized to test and that you can see logs from each hop.
- 5Ask with a natural request. Describe the parser difference you want to investigate, the hops involved and what you already captured.
- 6Review the paired requests. Check that the baseline and differential requests differ in only one dimension and that the logs show which hop diverges.
- 7Package the evidence. Keep the raw requests, per-hop decisions, route match and final effect together as one replayable example.
What the skill makes the agent do
An agent skill is a folder of instructions that an AI agent loads when a request matches the skill's description. This one covers places where a proxy and a backend server read the same HTTP request differently, such as path normalization, Host or forwarded headers, Content-Length and Transfer-Encoding framing, and routing outcomes that differ across hops.
The skill gives the agent a checklist. It asks the agent to map each parsing hop, record how each one handles paths, headers and framing, capture one accepted baseline request and one differential request that differ in a single detail, and show which hop interprets the request differently. The goal is a minimal replayable example that shows the difference and its final effect.
- Maps parsing hops: client-facing proxy, gateway, app server and downstream service
- Builds paired requests that change only one canonicalization dimension
- Classifies the root cause as path normalization drift, header ambiguity, transfer framing differential or host-derivation confusion
- Keeps raw requests, per-hop decisions and the final routed target together as evidence
What you need before installing
This skill is a downstream specialization. Its SKILL.md says it should be used only after the parent skill ctf-sandbox-orchestrator is already active and has set up sandbox assumptions, node ownership and evidence priorities. The parent skill is referenced but not included in these files, so you need to have it available yourself.
You also need a sandboxed lab target that you are authorized to test. The skill is not a standalone scanner. It gives the agent guidance and checklists, and the testing happens against your lab.
- The parent skill ctf-sandbox-orchestrator (not included in the download)
- A lab target you own or have written permission to test
- An agent environment that supports skills, such as the Claude apps or Claude Code
How to install the skill
Download the ZIP file from this page and unzip it. The package contains SKILL.md, references/request-normalization-smuggling.md and agents/openai.yaml. Then place the folder where your agent can find it, using one of the options below.
For a personal install, unzip it into ~/.claude/skills/. For a single project, unzip it into the project's .claude/skills/ folder. In the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.
- Personal: ~/.claude/skills/
- Project only: .claude/skills/ inside your project folder
- Claude apps: Settings → Capabilities → Skills, then upload
How to trigger the skill with natural requests
You do not need a special command. The agent loads the skill when your request matches its description. Mention the kind of parser difference you want to investigate. Name the proxy and backend if you have them, and say what you have already set up in the sandbox.
Because the skill is downstream, start by making sure the parent skill has run. The skill's own text says to return to ctf-sandbox-orchestrator first if that has not happened. You can refer to it as $ctf-sandbox-orchestrator in your request.
- Trace the parse differences between my proxy and backend for these two paths in my lab.
- Check whether Host and X-Forwarded-Host are read differently by the gateway and the app server.
- My lab has a CL/TE conflict. Help me build a baseline request and a one-change differential request.
- These two paths route to different backends across hops. Find the normalization difference.
- Using the sandbox assumptions from $ctf-sandbox-orchestrator, reduce this routing mismatch to a minimal replayable request.
Example: from a suspected mismatch to a minimal reproduction
Suppose a lab proxy forwards a path to an app server and the two respond differently to the same path with an encoded dot segment. Ask the agent to map the hops first. It should record how each one decodes the path and where the route match happens.
Next the agent builds a baseline request that the chain accepts, then a second request that changes only the encoding. The skill asks for proxy logs and backend logs for both, so you can see which hop routes the request to a different endpoint. The final output should be a single replayable request pair and a statement of which difference causes the effect.
- Baseline request: the normal request path that succeeds
- Differential request: one change only, such as the encoding of one segment
- Evidence: proxy log, backend log, route match and downstream request shape for each
Safety notes: scripts, network and authorization
The skill files do not run scripts and do not use the network by themselves. The requests the agent builds are meant for a target you control. Request smuggling probes can cause real harm, and aiming them at systems you do not own or lack permission to test may be illegal. Use only lab targets with written authorization.
The skill also replies in Simplified Chinese unless you explicitly ask for English, so say so in your request if you want English output.
- Do not point the paired requests at live, production or third-party systems
- Keep the lab isolated from networks you do not own
- Ask for English output explicitly if you need it
Tips for better results
Give the agent a clear starting point: which hops exist, what you already captured and what you suspect. The skill's checklist works best when it can compare hops side by side. Change one thing at a time, because changing several fields at once makes root cause hard to attribute, which the skill's own pitfalls list warns about.
Do not stop at a parser mismatch. The skill expects you to reproduce the final effect, such as a hidden endpoint reached or an auth branch taken. If the chain turns out to rely mainly on runtime routing with no framing tricks, the skill says to hand off to a runtime routing skill instead.
- Provide hop-by-hop details and the baseline request up front
- Change one field per differential request
- Keep raw requests and logs together for the final write-up
- Reproduce the final effect, not only the mismatch
What people use it for
- Explaining why a proxy and a backend route the same path to different endpoints in a CTF web lab
- Checking whether Host or forwarded headers are interpreted differently across a gateway and an app server
- Investigating Content-Length versus Transfer-Encoding framing disagreements in an authorized lab
- Writing up a reproducible request smuggling exercise with baseline and differential requests for a course or competition report
Frequently asked questions
Is the request normalization smuggling skill free?
This page does not state a price or licence terms for the skill beyond the listing details. The item is listed under the MIT licence, so check the licence text included with the source before you reuse it.
What do I need to install this agent skill?
You need the parent skill ctf-sandbox-orchestrator, which is referenced but not included in the download, and a sandboxed lab target you are authorized to test. You also need an agent environment that supports skills, such as the Claude apps or Claude Code.
Where do I put the skill folder after downloading?
Unzip it into ~/.claude/skills/ for a personal install or into .claude/skills/ in a project folder. In the Claude apps you can upload it under Settings → Capabilities → Skills.
Why does the agent reply in Chinese?
The skill's instructions say to reply in Simplified Chinese unless the user explicitly requests English. Ask for English in your request to change that.
Can this skill scan a website for request smuggling?
No. The skill is a specialist guide for an agent, not a finished scanner. It gives a checklist and helps build paired test requests, and it should only be used against lab targets you are authorized to test.
How is this different from a general pentesting tool?
It focuses on parser differentials between hops, such as proxy and backend disagreements about paths, Host headers and body framing. It depends on a parent skill for sandbox setup and does not run scripts or use the network itself.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a security student or engineer working on request smuggling in a CTF lab or your own controlled stack and you want an agent to follow a disciplined differential method. Pick something else if you need a standalone scanner or want to test systems you do not have written permission to test, because this skill is only guidance that depends on a parent skill.
Download the skill