reverse-skills-max: initial public release (restored, redacted, hardened)

reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-request-normalization-smuggling/SKILL.md

@@ -0,0 +1,50 @@
+---
+name: competition-request-normalization-smuggling
+description: Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for parser differentials, HTTP normalization gaps, ambiguous headers, path decoding drift, transfer-framing mismatches, and request smuggling routes. Use when the user asks to trace proxy and backend parse differences, conflicting path normalization, Host or forwarded-header ambiguity, CL/TE issues, or routing outcomes that differ across hops. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
+---
+
+# Competition Request Normalization Smuggling
+
+Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
+
+Use this skill when request interpretation changes between proxy, middleware, and backend parser layers.
+
+Reply in Simplified Chinese unless the user explicitly requests English.
+
+## Quick Start
+
+1. Map every parsing hop: client-facing proxy, gateway, app server, and downstream service.
+2. Record path normalization, header canonicalization, transfer framing, and host derivation at each hop.
+3. Capture one accepted baseline request and one differential request with minimal delta.
+4. Prove which hop interprets the request differently.
+5. Reproduce one minimal differential path that yields decisive behavior.
+
+## Workflow
+
+### 1. Map Parse And Routing Boundaries
+
+- Record `Host`, forwarded headers, path decoding, slash collapsing, dot-segment handling, and case behavior.
+- Note `Content-Length`, `Transfer-Encoding`, chunk framing, and connection reuse behavior when relevant.
+- Keep edge parser and backend parser decisions side by side.
+
+### 2. Prove Differential Interpretation
+
+- Build paired requests that differ in one canonicalization dimension only.
+- Capture proxy logs, backend logs, route match, and downstream request shape.
+- Show where route, auth scope, or body boundary diverges.
+
+### 3. Reduce To Decisive Smuggling Chain
+
+- Compress to: crafted request -> parser differential across hops -> unintended routed request or hidden endpoint reach -> resulting effect.
+- State whether root cause is path normalization drift, header ambiguity, transfer framing differential, or host-derivation confusion.
+- If the chain becomes primarily runtime routing without framing tricks, hand off to runtime routing skill.
+
+## Read This Reference
+
+- Load `references/request-normalization-smuggling.md` for parse-differential checklist and evidence packaging.
+
+## What To Preserve
+
+- Raw request pairs, hop-by-hop interpretation, and final routed target
+- Exact normalization or framing delta that flips behavior
+- One minimal replayable differential request path

reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-request-normalization-smuggling/agents/openai.yaml

@@ -0,0 +1,7 @@
+interface:
+  display_name: "Competition Request Normalization Smuggling"
+  short_description: "Trace parser drift, header ambiguity, and request smuggling"
+  default_prompt: "After $ctf-sandbox-orchestrator is active, use $competition-request-normalization-smuggling to trace parser differentials, header ambiguity, and route smuggling in this challenge."
+
+policy:
+  allow_implicit_invocation: false

reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-request-normalization-smuggling/references/request-normalization-smuggling.md

@@ -0,0 +1,27 @@
+# Request Normalization Smuggling Checklist
+
+## First Pass
+
+- Front proxy, gateway, backend parser, internal service chain
+- Path decode rules, slash and dot handling, case normalization, host derivation
+- Header canonicalization, duplicate header behavior, CL/TE handling, chunk parsing
+
+## Chain To Reconstruct
+
+1. Baseline request path captured
+2. Differential request crafted with one delta
+3. Parser or router divergence observed
+4. Unintended route or request body boundary reached
+5. Decisive effect reproduced
+
+## Evidence To Keep Together
+
+- Request side: raw baseline and differential requests
+- Hop side: each parser decision and route match per hop
+- Effect side: hidden endpoint access, auth bypass branch, or state mutation
+
+## Common Pitfalls
+
+- Changing multiple fields at once and losing root-cause attribution
+- Looking only at frontend proxy logs without backend route evidence
+- Reporting parser mismatch without reproducing final effect