CtrlK
BlogDocsLog inGet started
Tessl Logo

waf

Configures AWS WAF to filter web traffic: creating web access control lists (web ACLs) on CloudFront, Application Load Balancers, API Gateway, and AppSync; AWS Managed Rules tuned in Count mode; rate-based rules for HTTP floods; IP set and geographic match rules; Bot Control (Common and Targeted); turning bot labels into a confidence signal; stripping spoofed inbound x-amzn-waf-* headers; recovering the real client IP behind a CDN; Fraud Control (account takeover and account creation fraud prevention); and logging and request sampling. Use when the user wants to protect a web application or API from common exploits, bots, credential stuffing, fake-account creation, or HTTP floods at the application layer (layer 7). Routes to the right per-task procedure in references. Do NOT use for L3/L4 DDoS protection (shieldadvanced skill), multi-account WAF rollout (firewallmanager skill), CloudFront configuration (cloudfront skill), or Route 53 health checks or records (route53 skill).

69

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

70%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured router with clear sequencing, explicit verification guidance, and clean one-level-deep progressive disclosure into 13 reference files. Its main weaknesses are minor redundancy across sections and the absence of executable code in the body itself, which is acceptable for a router but leaves actionability one notch below the top anchor.

Suggestions

Remove the duplicated web-ACL scope statement (it appears in both Overview and Routing notes) and consolidate it into one location to tighten conciseness.

Prune Routing notes that merely restate rows already in the routing table, keeping only the notes that add sequencing or cross-reference guidance not visible in the table.

Consider adding one or two concrete AWS CLI command stubs (e.g. aws wafv2 list-web-acls) in the body so the router gives at least minimal copy-paste-ready actionability before delegating.

DimensionReasoningScore

Conciseness

The body is mostly lean and avoids explaining basic concepts, but the web-ACL scope fact is restated in both the Overview and Routing notes, and the Security Considerations and several Routing notes restate information already implied by the routing table, so it could be tightened further.

2 / 3

Actionability

Concrete cross-cutting guidance is present (specific wafv2: actions, the us-east-1/CLOUDFRONT scope rule, the mandatory header-strip rule), but the body itself contains no executable code or CLI commands — those details live in the reference files it routes to.

2 / 3

Workflow Clarity

Sequencing is explicit and ordered ('Logging comes before tuning', 'Bot Control is a chain ... in that order', 'Forwarded headers need the strip rule'), and there is a verification checkpoint: 'MUST confirm the web ACL is associated and that its posture matches the intended default ... before reporting setup complete.'

3 / 3

Progressive Disclosure

A concise overview plus a well-signaled routing table links to 13 one-level-deep reference files (all verified present), each paired with a descriptive goal, giving easy navigation and an appropriate content split.

3 / 3

Total

10

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is a strong, third-person router description that enumerates concrete capabilities, supplies explicit 'Use when' triggers, and draws clear boundaries against adjacent skills. It is comprehensive without resorting to vague fluff.

DimensionReasoningScore

Specificity

Lists many concrete actions — 'creating web ACLs ... on CloudFront, Application Load Balancers, API Gateway, and AppSync', 'Managed Rules tuned in Count mode', 'rate-based rules', 'IP set and geographic match rules', 'Bot Control', 'stripping spoofed inbound x-amzn-waf-* headers' — matching the top anchor for multiple specific concrete actions.

3 / 3

Completeness

Explicitly answers both what (the long capability list) and when via the 'Use when the user wants to protect a web application or API ...' clause, satisfying the top anchor.

3 / 3

Trigger Term Quality

Includes natural phrasings users would actually say — 'protect a web application or API from common exploits, bots, credential stuffing, fake-account creation, or HTTP floods' — giving good coverage of common variations.

3 / 3

Distinctiveness Conflict Risk

Clear AWS WAF layer-7 niche plus an explicit 'Do NOT use for L3/L4 DDoS protection (shieldadvanced skill), multi-account WAF rollout (firewallmanager skill) ...' boundary, making conflicts with sibling skills unlikely.

3 / 3

Total

12

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
aws/agent-toolkit-for-aws
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.