waf-bypass

WAF evasion — payload obfuscation, HTTP-level evasion, origin-IP discovery, rate/anomaly evasion, per-WAF notes (Cloudflare/Akamai/AWS WAF/ModSecurity).

Quality

84%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A lean, highly actionable reference with copy-paste commands, a clear numbered workflow, and a decision gate — among the better skill bodies. The main weakness is progressive disclosure: it leans on external sibling-skill paths that are not present as bundle files and inlines material that could be split out.

Suggestions

Either bundle the referenced sibling skills (waf-detection, smuggling, hpp, etc.) under references/ or mark the cross-reference paths as external/non-bundled so navigation expectations are clear.

Consider moving the per-WAF notes (sec 6) and detection signatures (sec 8) into reference files (e.g. references/per-waf-notes.md) to keep SKILL.md an overview, signaling them with one-level-deep links.

Add an explicit validate→fix→retry feedback loop for the origin-IP confirmation step (sec 4.5) so the workflow checkpoint matches the rubric's destructive/batch-operation feedback-loop expectation.

Dimension	Reasoning	Score
Conciseness	The body is dense and assumes Claude's competence — no padding explaining what a WAF or a SQL injection is, every line is a technique, command, or table row, and each token earns its place.	5 / 5
Actionability	Copy-paste ready curl/sqlmap commands cover the common cases (chunked smuggling, origin discovery, AWS WAF body-cap bypass, distributed scanning) with concrete flags and payloads rather than abstract direction.	5 / 5
Workflow Clarity	Sections are numbered into a clear progression (recon → obfuscation → HTTP-level → origin-IP → rate evasion → per-WAF), with a decision-gate table (sec 9) and origin-validation checkpoint (sec 4.5); minor gap is that not every branch has an explicit validate→fix→retry loop.	4 / 5
Progressive Disclosure	No references/scripts/assets bundle exists, yet the body cross-references six sibling SKILL.md paths (waf-detection, smuggling, hpp, verb-tampering, sqli, subdomain-takeover) that are not bundled here and whose existence cannot be verified; references are signaled but content that could live in separate files (per-WAF notes, detection signatures) is inlined.	3 / 5
	Total	17 / 20 Passed

Description

82%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, well-triggered description that clearly delineates the WAF-bypass niche and lists concrete capabilities plus vendor coverage. The only gap is the absence of an explicit 'Use when...' clause in the description field itself, which caps completeness.

Suggestions

Add an explicit 'Use when...' clause to the description, e.g. 'Use when bypassing or evading a WAF (Cloudflare, Akamai, AWS WAF, ModSecurity) during authorized testing.'

Fold one or two of the metadata.when_to_use trigger phrases directly into the description so the trigger guidance travels with the description field.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete capabilities — 'payload obfuscation, HTTP-level evasion, origin-IP discovery, rate/anomaly evasion, per-WAF notes' — with named vendors, giving comprehensive coverage.	5 / 5
Completeness	Has a clear 'what' enumerating concrete actions, but the description field lacks any explicit 'Use when...' clause; per rubric guidance a missing trigger clause caps completeness at 3 even though when_to_use metadata exists.	3 / 5
Trigger Term Quality	Combines the natural phrase 'WAF evasion' with explicit trigger terms in metadata.when_to_use ('WAF bypass, Cloudflare bypass, Akamai bypass, payload obfuscation, origin IP discovery'), covering synonyms and vendor variants users would say.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (per-vendor WAF bypass) with distinct, specific triggers unlikely to fire for unrelated skills.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/web/waf-bypass/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.