cache-poisoning-smuggling

Warn

Audited by Socket on Sep 23, 2026

2 alerts found:

Securityx2
SecurityMEDIUM
SKILL.md

SUSPICIOUS/HIGH-RISK skill. It is internally consistent as an exploit skill, but its purpose is to enable offensive web attacks against targets, including cache poisoning, request smuggling, ACL bypass, and token theft. No strong malware or credential-harvesting indicators are present, yet the capability itself is dangerous for an AI agent and creates substantial abuse risk.

Confidence: 90%Severity: 88%
SecurityMEDIUM
evals/evals.json

This JSON fragment is an exploit-focused prompt/template package designed to guide generation of actionable HTTP request smuggling payloads (CL.TE, TE.TE) and CDN cache poisoning leading to persistent XSS via unkeyed headers (X-Forwarded-Host). It contains no executable malware logic, but it meaningfully enables real-world attack execution when consumed by an agent/harness, making it a high security risk from a supply-chain/security standpoint.

Confidence: 82%Severity: 92%
Audit Metadata
Analyzed At
Sep 23, 2026, 04:28 AM
Package URL
pkg:socket/skills-sh/wgpsec%2Faboutsecurity%2Fcache-poisoning-smuggling%2F@c50488eb456a5648253eba5440d79ac4771a5583724bbbce8a58f929a0da5526