What problem does it solve? HTTP request smuggling and desync signals from scanners are noisy and hard to act on. This Skill routes a broad smuggling signal through a triage router, selects at most three relevant technique cards from 32 variants (CL.TE, TE.CL, H2.CL, CL.0, h2c, HTTP/3 contamination, and more), and produces a structured assessment with explicit false-positive controls and safety gates. ## Core Features & Use Cases - Signal Routing: A router maps evidence types (conflicting CL/TE, HTTP/2 downgrade, early response, cache anomalies) to specific technique cards instead of loading everything. - 32 Technique Cards: Each card defines when to consider the variant, evidence to collect, false-positive controls, and safe validation boundaries. - Structured Output: Enforces an output schema with status values like needs_more_evidence, hypothesis_ready, and manual_proof_contract_required. - Safety Gates: Separates an automatic lane (GET/HEAD inventory, passive observation) from a manual-gated lane (malformed framing, queue poisoning, timing probes). - Use Case: A scanner flags possible CL.TE desync on an API gateway. The Skill routes the signal, loads the cl-te and te-cl cards, and returns a hypothesis naming the parser boundary, missing evidence, and one safe next step. ## Quick Start Ask the agent to triage a suspected HTTP request smuggling signal on a target host and return a structured desync assessment using the router and output schema.
