request-smuggling
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSOBFUSCATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references third-party security tools on GitHub (defparam/smuggler, dhmosfunk/simple-http-smuggler-generator, h2csmuggler, and http2smugl) for automated smuggling detection and payload generation.
- [OBFUSCATION]: The skill documents methods to obfuscate HTTP headers to bypass proxy/WAF parsing, including malformed syntax (tabs, spaces, line continuations) and the use of specific Unicode characters (U+760D U+760A) that act as hidden CRLF sequences.
- [INDIRECT_PROMPT_INJECTION]: 1. Ingestion points: HTTP response streams and header values from external web servers. 2. Boundary markers: No boundary markers or 'ignore' instructions are defined for processing target responses. 3. Capability inventory: The skill utilizes network operations via curl and fetch. 4. Sanitization: No sanitization or validation logic is provided for external data before it is processed by the agent.
- [DYNAMIC_EXECUTION]: The skill provides functional JavaScript templates for Client-Side Desync (CSD) attacks, which are designed to be generated and executed to test connection-reuse vulnerabilities.
Audit Metadata