Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
DeepSeek
Muse+22 moreClaude CodeCursorCodex CLIDeepSeekMuse
Dots
Manus
Grok
Grok Bot+18 agentsRepair TLS SNI Routing Bugs
The problem Multi-tenant gateways and proxies often suffer from SNI leakage where wildcard matches cross boundaries or cached TLS contexts bleed between tenants.
$1
Repair TLS SNI Routing Bugs
Example session with this skill installed
Our Node TLS gateway routes SNI with hostname.endsWith(configuredName). A tenant named notexample.com can match example.com, and the context cache ignores the configuration generation. Repair with local certificates and handshakes. Preserve TLS versions, ciphers, ALPN, default policy, reload behavior, and errors.
- Read your context and instructions
- Compiled the repair tls sni
SNI authority defect found. Raw suffix matching lacks a label boundary, and cached secure contexts are keyed only by normalized name rather than configuration generation. The repair uses exact and standards-bounded wildcard matching, binds contexts to immutable reload generations, preserves TLS/ALPN/default behavior, and validates adversarial names and concurrent local handshakes without disabling verification.
Connects securely to your tools. The creator never sees your data.
About this skill
The problem
Multi-tenant gateways and proxies often suffer from SNI leakage where wildcard matches cross boundaries or cached TLS contexts bleed between tenants. These routing bugs lead to incorrect certificate selection, broken upstream dispatch, and security vulnerabilities during configuration reloads.
What it does
- Identifies and repairs SNI normalization issues including case sensitivity, trailing dots, and IDNA encoding.
- Enforces exact routing precedence to prevent suffix match hijacking (e.g., evil-example.com matching example.com).
- Fixes race conditions between configuration hot-reloads and in-flight ClientHello handshakes.
- Audits TLS context callbacks to ensure cached state is bound to the correct authority and tenant.
- Generates deterministic local handshake fixtures and loopback tests to verify routing logic without production access.
Frameworks & tools
Works with repository-level configurations for TLS terminators, proxies, and gateways. Uses Read, Edit, and Bash for local environment validation.
Why this beats prompting it yourself
General LLMs often suggest weakening certificate validation or increasing timeouts to "fix" connection errors. This skill enforces a strict ownership contract, ensuring validation occurs before dispatch and that observability remains redacted and protocol-compliant.
Use cases
- Fixing wildcard certificate routing that incorrectly matches multi-label subdomains.
- Preventing tenant context leakage in high-concurrency TLS termination environments.
- Hardening SNI parsers against malformed or ambiguous authority headers.
- Validating that configuration reloads do not interrupt or misroute active TLS handshakes.
Known limitations
Cannot contact production services or read live secrets. It does not modify TLS versions, cipher policies, or global ALPN settings without explicit repository evidence.
Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for Agents & Orchestration.
Cannot choose or change TLS versions, cipher policy, certificate validation, ALPN, default-route policy, reload semantics, and public handshake errors; cannot verify production infrastructure or prove every runtime, proxy, network, or scheduler ordering.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before buying a skill.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scan
Security scan passed 2 months ago
Permissions
Run on a clean branch with repository files and disposable local fixtures. Review every patch and validation result before merge. Keep production services, real credentials, customer payloads, and deployment out of scope.