CtrlK
BlogDocsLog inGet started
Tessl Logo

smuggling

HTTP Request Smuggling (HRS) — front-end / back-end parser disagreement attacks that desync the proxy stack. Covers CL.TE, TE.CL, TE.TE, CL.0, HTTP/2 downgrade (h2.cl, h2.te), pipelining, and connection-state pinning. Includes a confirm-desync gate, header obfuscation catalog, and minimal raw-socket Python harnesses (no smuggler.py available in sandbox).

60

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/web/smuggling/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

77%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with a clear, well-validated workflow, but its length and repetition tax conciseness and its monolithic structure leaves progressive disclosure underused.

Suggestions

Extract the Class C diagnostic-reflection and triple-tier desync matrix into separate reference files (e.g. CLASS_C.md, TIER_MATRIX.md) and reference them one level deep to improve progressive disclosure.

Deduplicate the repeated "do not brute-force admin credentials" guidance into a single canonical statement and back-reference it from the other sections.

Tighten or collapse the repeated Anti-Patterns block so the same timeout/socket-discipline rules appear once instead of multiple times.

DimensionReasoningScore

Conciseness

The ~650-line body is dense and operational rather than padded with basic concepts, but it repeats guidance verbatim across sections (the "do not brute-force admin credentials" warning appears 4+ times, anti-patterns restated repeatedly) that could be tightened.

2 / 3

Actionability

It provides fully executable raw-socket Python harnesses, copy-paste bash probes, a concrete header-obfuscation table, and specific h2 client code — matching the fully-executable anchor.

3 / 3

Workflow Clarity

A clear sequence (Confirm-Desync Gate → Variant Catalog → Class A/B/C routing → Verification) with explicit validation checkpoints, gate pass criteria, repro-3x verification, and feedback loops for error recovery.

3 / 3

Progressive Disclosure

No bundle files exist and the skill is a single ~650-line monolith; substantial inline content (Class C diagnostic-reflection, triple-tier desync matrix) would benefit from split reference files, though sections are well-organized.

2 / 3

Total

10

/

12

Passed

Description

67%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and occupies a clearly distinct niche, but it leans heavily on jargon and lacks an explicit "Use when..." trigger clause within the description field, capping trigger-term quality and completeness.

Suggestions

Add an explicit "Use when..." trigger clause to the description (e.g., "Use when you see HTTP request smuggling, HRS, desync, or proxy parser disagreement") rather than relying on metadata.when_to_use.

Lead with natural phrasings a user would say ("request smuggling", "request desync") before the CL.TE/h2.cl acronym catalog to improve trigger-term quality.

Trim the acronym list or move it after the natural trigger so the headline reads less jargon-heavy.

DimensionReasoningScore

Specificity

"Covers CL.TE, TE.CL, TE.TE, CL.0, HTTP/2 downgrade (h2.cl, h2.te), pipelining, and connection-state pinning" plus a confirm-desync gate and raw-socket harnesses lists multiple concrete actions, matching the multi-action anchor.

3 / 3

Completeness

It clearly states what the skill covers but has no "Use when..." trigger clause in the description itself (triggers live in metadata.when_to_use), and the rubric caps completeness at 2 for missing explicit trigger guidance.

2 / 3

Trigger Term Quality

The natural headline terms "HTTP Request Smuggling (HRS)" and "desync" are present, but the field is dominated by jargon acronyms (CL.TE, h2.cl, h2.te) a user would not naturally say and omits common phrasings like bare "request smuggling".

2 / 3

Distinctiveness Conflict Risk

HTTP Request Smuggling / desync is a sharply defined niche with distinctive technical triggers that are unlikely to fire for unrelated skills.

3 / 3

Total

10

/

12

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

skill_md_line_count

SKILL.md is long (657 lines); consider splitting into references/ and linking

Warning

metadata_version

'metadata.version' is missing

Warning

Total

14

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.