Content
96%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is an exemplary dense field reference: lean, fully executable, and sequenced with explicit validation checkpoints and a decision gate covering escalation and stop conditions. The only structural improvement is moving the per-WAF notes and payload matrices into bundled reference files to keep SKILL.md as a tighter overview.
Suggestions
Move §6 per-WAF notes (and possibly the §2 obfuscation matrix) into references/ files (e.g. references/waf-notes.md) with one-line summaries inline, keeping SKILL.md as the navigable overview.
Fix the minor inaccuracy in §5: 'curl's --ja3' — JA3 rotation is done via the separate curl-impersonate binary, not a curl flag.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is dense and lean: a one-line mental model ('A WAF is a signature + score engine in front of the origin'), compact tables, and copy-paste commands with zero filler and no explanation of concepts Claude already knows. Every section earns its tokens; even the defender-facing section 8 is a tight table rather than prose. | 5 / 5 |
Actionability | Fully executable, copy-paste-ready commands throughout: wafw00f/nuclei fingerprinting, concrete obfuscation payloads ('-1'/*!50000UnIoN*/(/*!50000SeLeCt*/...'), the chunked-transfer POST, the AWS WAF 9KB body-cap bypass with a python one-liner, shodan/censys origin-discovery queries, and an md5-diff origin validation. The examples cover the common cases; only section 4.3 is a comment-only hint. | 5 / 5 |
Workflow Clarity | A clear ordered sequence (recon first, then §2 obfuscation → §3 HTTP-level → §4 origin) with explicit validation in §4.5 (body-hash + cert confirmation, 'Same hash + no WAF headers = origin reached') and a §9 decision gate that provides feedback loops and error recovery (429 → back off; all attempts blocked → pivot; program forbids → stop). | 5 / 5 |
Progressive Disclosure | Sections are well-organized and the cross-references to sibling skills (waf-detection, smuggling, hpp, sqli) are clearly signaled in a dedicated section and one level deep. However, no bundle files exist, and dense per-WAF notes (§6) and the obfuscation matrix (§2) are inline reference material that could be split into references/ files — good structure with minor organization gaps, matching anchor 4 rather than 5. | 4 / 5 |
Total | 19 / 20 Passed |