Agent skill

Waf Bypass Techniques

当payload被拦截、请求被WAF/过滤/403拒绝、连续多次payload失败、需要绕过黑名单/白名单/正则/语义分析防御时调用。负责编码/变形/逻辑/协议层绕过、换入口、组合利用与时间维度攻击的完整升级路径。

MITAuto-check passedSecurity

Install Waf Bypass Techniques

skills CLI

$ npx skills add zhaji2333/CkSKILLS --skill waf-bypass-techniques -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install zhaji2333/CkSKILLS waf-bypass-techniques --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/waf-bypass-techniques .claude/skills/waf-bypass-techniques && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "waf-bypass-techniques" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/waf-bypass-techniques into .claude/skills/waf-bypass-techniques/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "waf-bypass-techniques", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/waf-bypass-techniques

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add zhaji2333/CkSKILLS --skill waf-bypass-techniques -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install zhaji2333/CkSKILLS waf-bypass-techniques --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.agents/skills/waf-bypass-techniques .agents/skills/waf-bypass-techniques && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "waf-bypass-techniques" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/waf-bypass-techniques into .agents/skills/waf-bypass-techniques/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "waf-bypass-techniques", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add zhaji2333/CkSKILLS --skill waf-bypass-techniques -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install zhaji2333/CkSKILLS waf-bypass-techniques --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.agents/skills/waf-bypass-techniques .cursor/skills/waf-bypass-techniques && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "waf-bypass-techniques" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/waf-bypass-techniques into .cursor/skills/waf-bypass-techniques/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "waf-bypass-techniques", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/zhaji2333/CkSKILLS.git --path .agents/skills/waf-bypass-techniques

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add zhaji2333/CkSKILLS --skill waf-bypass-techniques -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install zhaji2333/CkSKILLS waf-bypass-techniques --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.agents/skills/waf-bypass-techniques .gemini/skills/waf-bypass-techniques && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "waf-bypass-techniques" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/waf-bypass-techniques into .gemini/skills/waf-bypass-techniques/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "waf-bypass-techniques", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install zhaji2333/CkSKILLS waf-bypass-techniques

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add zhaji2333/CkSKILLS --skill waf-bypass-techniques -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .github/skills && cp -r skills-src/.agents/skills/waf-bypass-techniques .github/skills/waf-bypass-techniques && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "waf-bypass-techniques" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/waf-bypass-techniques into .github/skills/waf-bypass-techniques/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "waf-bypass-techniques", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add zhaji2333/CkSKILLS --skill waf-bypass-techniques -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install zhaji2333/CkSKILLS waf-bypass-techniques --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/zhaji2333/CkSKILLS.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.agents/skills/waf-bypass-techniques .opencode/skills/waf-bypass-techniques && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "waf-bypass-techniques" agent skill from https://github.com/zhaji2333/CkSKILLS/tree/main/.agents/skills/waf-bypass-techniques into .opencode/skills/waf-bypass-techniques/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "waf-bypass-techniques", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: waf-bypass-techniques
GitHub stars: 115
Token cost: ~620 tokens
SKILL.md length: 98 words
Files: 1
Skills in repo: 15
Repo updated: Sep 15, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

Works in 6 steps: 这个防御是在哪一层做的？（WAF/应用层/框架层/数据库层） → 防御的规则是什么？（黑名单/白名单/正则/语义分析） → 规则的边界在哪？（哪些情况没覆盖到） → …
Tasks that involve Web application vulnerabilities
SKILL.md covers 何时调用（触发条件）, 一、对抗意识框架（先定位再绕过）, 二、失败升级路径（Level 1-7） and 三、通用绕过技术库, plus 4 more sections
Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Waf Bypass Techniques is an agent skill from zhaji2333/CkSKILLS. 当payload被拦截、请求被WAF/过滤/403拒绝、连续多次payload失败、需要绕过黑名单/白名单/正则/语义分析防御时调用。负责编码/变形/逻辑/协议层绕过、换入口、组合利用与时间维度攻击的完整升级路径。

Its SKILL.md is about 620 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Web application vulnerabilities. The repository describes itself as: 基于 Claude Code / Codex 的 SRC 漏洞挖掘 Agent 技能体系 —— 将顶尖安全研究员的方法论沉淀为可调度、可复用的 Skill 知识资产。 The licence is MIT.

When your agent uses it

Tasks that involve Web application vulnerabilities

Example prompts

“/waf-bypass-techniques”

Workflow steps

6 steps, taken from the first numbered list in SKILL.md.

这个防御是在哪一层做的？（WAF/应用层/框架层/数据库层）
防御的规则是什么？（黑名单/白名单/正则/语义分析）
规则的边界在哪？（哪些情况没覆盖到）
能否通过协议差异绕过？（代理和后端解析不一致）
能否通过编码差异绕过？（不同层对编码的处理不同）
能否通过逻辑差异绕过？（校验和执行不是同一段代码）

What it can do on your machine

Read from SKILL.md and the folder at commit 482fe78. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Waf Bypass Techniques loads about 620 tokens when it runs. Until then it costs about 32 tokens; SKILL.md has 98 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~32
When it runs · the whole SKILL.md, loaded when a task matches: ~620

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from zhaji2333/CkSKILLS at commit 482fe78, republished under its MIT licence (© zhaji2333). 98 words, ~620 tokens.

Download SKILL.mdSave it as .claude/skills/waf-bypass-techniques/SKILL.md (or your agent's skills folder).

name: waf-bypass-techniques
description: 当payload被拦截、请求被WAF/过滤/403拒绝、连续多次payload失败、需要绕过黑名单/白名单/正则/语义分析防御时调用。负责编码/变形/逻辑/协议层绕过、换入口、组合利用与时间维度攻击的完整升级路径。

waf-bypass-techniques — 绕过与对抗专项深度挖掘

何时调用（触发条件）

payload 被 WAF/过滤器/防火墙拦截
403 拒绝、请求被改写/丢弃
连续 3 次 payload 失败（停止同方向硬刚）
黑名单/白名单/正则/语义分析防御
需要跨层绕过（代理与后端解析差异）

一、对抗意识框架（先定位再绕过）

遇到防御时的思考框架：

这个防御是在哪一层做的？（WAF/应用层/框架层/数据库层）
防御的规则是什么？（黑名单/白名单/正则/语义分析）
规则的边界在哪？（哪些情况没覆盖到）
能否通过协议差异绕过？（代理和后端解析不一致）
能否通过编码差异绕过？（不同层对编码的处理不同）
能否通过逻辑差异绕过？（校验和执行不是同一段代码）

二、失败升级路径（Level 1-7）

Level 1: 编码绕过
  → URL编码/双重编码/Unicode/十六进制/HTML实体/Base64

Level 2: 变形绕过
  → 大小写混合/双写/注释插入/空白符替换/等价函数

Level 3: 逻辑绕过
  → 换HTTP方法/换Content-Type/换参数位置/利用解析差异

Level 4: 协议层绕过
  → HTTP走私/分块传输/管道化/WebSocket升级

Level 5: 换入口点
  → 同功能的其他接口/旧版本接口/移动端接口/内部接口

Level 6: 组合利用
  → A接口的信息泄露 + B接口的弱校验 = 完整攻击链

Level 7: 时间维度
  → 并发/竞态/延时/定时任务触发

硬性规则：至少尝试到 Level 4 才能下"无漏洞"结论。

三、通用绕过技术库

编码类

URL 编码 / 双重编码（%252e）
Unicode（\u002e、全角字符）
十六进制 / 八进制 / 十进制 IP
HTML 实体 / Base64 / 分块编码

变形类

大小写混合（SeLeCt）
双写（selselectect）
注释插入（/**/、/!/）
空白符替换（%09、%0a、${IFS}）
等价函数/等价标签

逻辑类

换 HTTP 方法（POST↔GET、PUT、PATCH）
换 Content-Type（JSON↔form↔multipart）
参数位置迁移（参数名→参数值→Header→Cookie→Path）
参数污染（重复参数、数组化）

协议类

HTTP 走私（CL/TE 差异）
分块传输（Transfer-Encoding: chunked）
管道化、WebSocket 升级
路径标准化差异（//、/./、/../、%2e）

四、分类绕过速查

SQL 注入绕过

大小写：SeLeCt / 双写：selselectect
注释：/**/、/*!*/、--+、#
编码：URL编码、十六进制、Unicode
等价函数：substr→mid、ascii→ord

XSS 绕过

HTML实体：&#60;script&#62;
事件：onerror/onload/onfocus/onmouseover
标签：<svg>、<img>、<iframe>、<math>
伪协议：javascript:、data:

命令注入绕过

分隔符：| / || / & / && / ; / %0a
空格：${IFS} / $IFS$9 / %09 / {cat,/etc/passwd}
通配符：/???/??t /etc/passwd

文件上传绕过

扩展名：.php5/.phtml/.phar/.htaccess/.user.ini
双扩展：shell.php.jpg / shell.jpg.php
%00截断：shell.php%00.jpg
内容：GIF89a头、图片马

SSRF 绕过

IP混淆：十进制/十六进制/八进制
重定向：302跳转、DNS重绑定
协议差异：@符号、URL解析差异

五、403 绕过专项

X-Forwarded-For: 127.0.0.1
X-Real-IP: 127.0.0.1
X-Original-URL: /admin
X-Rewrite-URL: /admin
路径变体：/admin/、//admin、/./admin、/admin%2f、/ADMIN
方法替换：GET→POST→OPTIONS→X-HTTP-Method-Override
分号截断：/admin;.css、/admin;.js

六、验证要点

每次绕过尝试保留基线请求（被拦的原始请求）对比
确认拦截层：WAF/网关/应用层过滤（响应头/错误页差异）
绕过成功标准：响应恢复为业务正常响应（非拦截页）
多维度组合：编码+变形+协议同时使用
换入口优先尝试：移动端接口、旧版本接口、内部接口通常防护更弱

七、注意事项

绕过成功 ≠ 漏洞成立：仍须验证业务影响
保留证据链：拦截响应 + 绕过后响应
不无限硬刚同一方向：连续 3 次失败即升级 Level

Files

Just SKILL.md in .agents/skills/waf-bypass-techniques of zhaji2333/CkSKILLS.

Open the folder on GitHubat commit 482fe78

Compare with similar skills

Waf Bypass Techniques next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Waf Bypass Techniques compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Waf Bypass Techniques this skillzhaji2333/CkSKILLS	115	—	~620	Automated safety check: Pass	MIT	26 days ago
Security And Hardeningpenpot/penpot	61k	6 repos	~4.7k	Automated safety check: Notes	MPL-2.0	yesterday
Security Auditoreigent-ai/eigent	15k	—	~1.8k	Automated safety check: Notes	Apache-2.0	yesterday
Security Reviewjewbetcha/opentrace	116	18 repos	~3.1k	Automated safety check: Notes	MIT	4 mo ago
Strix Code Vulnerability Scanusestrix/strix	68k	—	~1.1k	Automated safety check: Pass	Apache-2.0	today
Code Audit3stoneBrother/code-audit	892	1 repos	~2.7k	Automated safety check: Pass	None	8 mo ago

Similar skills

Security And Hardening
penpot/penpot
Hardens code against vulnerabilities. An agent skill from penpot/penpot.
61k GitHub starsUsed in 6 repos~4.7k tokens
SecurityAuto-check: notes
Security Auditor
eigent-ai/eigent
Audits source code, dependencies and config files for vulnerabilities and hardcoded secrets, using two bundled Python scanners and an OWASP Top 10 checklist.
15k GitHub stars~1.8k tokensUpdated yesterday
SecurityAuto-check: notes
Security Review
jewbetcha/opentrace
A skill your agent uses when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features.
116 GitHub starsUsed in 18 repos~3.1k tokens
SecurityAuto-check: notes
Strix Code Vulnerability Scan
usestrix/strix
Runs a Strix white-box security review that reads the source, then exploits what it finds in a sandbox so each reported issue has a proof-of-concept.
68k GitHub stars~1.1k tokensUpdated today
SecurityAuto-check passed
Code Audit
3stoneBrother/code-audit
Professional code security audit skill covering 55+ vulnerability types.
892 GitHub starsUsed in 1 repo~2.7k tokens
SecurityAuto-check passed
Fix Strix Security Findings
usestrix/strix
Triages findings from a Strix pentest by severity, fixes each root cause with a minimal change, and re-runs Strix to confirm the exploit no longer works.
68k GitHub stars~1.5k tokensUpdated today
SecurityAuto-check passed

More from zhaji2333/CkSKILLS

All 15 skills in this repo

Apk Reversing
zhaji2333/CkSKILLS
当需要获取目标 APK、识别加固壳类型、脱壳还原 dex、反编译得到 Java/so/H5 全量源码产物，或 android-security-audit 需要可直接开挖的输入时调用。负责 APK → 全量可审计产物（壳识别 → 脱壳 → JADX 反编译 + apktool 资源 + so 提取 + H5/assets 提取）→ 标准目录交付。命中场景：JADX 打开是…
115 GitHub stars~1.7k tokensUpdated 26 days ago
Auto-check passed
Asc Fast Hunt
zhaji2333/CkSKILLS
当需要在不对 APK 全量反编译的前提下秒级定位硬编码密钥/签名函数/隐藏接口/调试后门，或 APK 过大（100MB）JADX 全量反编译过慢、内存吃紧，或脱壳产物（裸 dex）需要快速检索，或只想先读一下 Manifest 组件面/权限清单时调用。负责基于 Droid ASC 的零预处理快速定位（findrefs 全局交叉引用搜索 + getclass 按需反编译 + Manifest…
115 GitHub stars~3.3k tokensUpdated 26 days ago
Auto-check passed
Business Logic Race
zhaji2333/CkSKILLS
当目标存在支付/下单/退款/提现/转账/优惠券/积分/红包/会员/订阅/审批/库存/抽奖等业务功能，或发现状态可跳变、金额参数可控、并发可重放时调用。负责业务状态机建模、金额篡改、订单状态跳变、竞态条件与重放攻击深度挖掘。
115 GitHub stars~466 tokensUpdated 26 days ago
Auto-check passed
AI LLM Agent Security
zhaji2333/CkSKILLS
当目标为 LLM 应用/Chatbot/智能客服/AI 助手/Copilot/Agent/RAG 知识库/多模态模型，或发现用户输入进入大模型提示、工具调用、知识库检索、对话记忆、文件解析，或需要测试提示词注入/越狱逃逸/System Prompt 泄露/训练数据与敏感信息泄露/RAG 检索污染/Agent 记忆污染/工具滥用与命令执行/SSRF/沙箱逃逸时调用。负责 OWASP LLM…
115 GitHub stars~4.7k tokensUpdated 26 days ago
Auto-check: warnings
Hunt Clueboard
zhaji2333/CkSKILLS
当开始挖新目标、换会话/压缩后续挖、用户说线索板/写板/读板/建板，或信息收集、反编译、JS/接口线索需要跨轮保留时调用。负责为当前系统维护一份 Markdown 线索板（读→挖→写回），不负责拆 webpack、打越权或成稿。模板见同目录 CLUEBOARD.template.md。
115 GitHub stars~606 tokensUpdated 26 days ago
Auto-check passed
Cloud Infra Supply Chain
zhaji2333/CkSKILLS
当目标涉及云资产（对象存储/云元数据/Serverless）、容器/K8s、运维面板（宝塔/Grafana/Zabbix/Jenkins/GitLab/Nacos等）、消息队列/缓存中间件、CI/CD流水线、第三方回调集成、依赖组件CVE、信息泄露配置时调用。负责未授权访问、弱口令、云配置错误、供应链漏洞与敏感信息挖掘。
115 GitHub stars~688 tokensUpdated 26 days ago
Auto-check: warnings

Questions about Waf Bypass Techniques

What does Waf Bypass Techniques do?

当payload被拦截、请求被WAF/过滤/403拒绝、连续多次payload失败、需要绕过黑名单/白名单/正则/语义分析防御时调用。负责编码/变形/逻辑/协议层绕过、换入口、组合利用与时间维度攻击的完整升级路径。. Waf Bypass Techniques is an agent skill from zhaji2333/CkSKILLS.

When should I use Waf Bypass Techniques?

Waf Bypass Techniques fits situations like: tasks that involve Web application vulnerabilities.

How do I install Waf Bypass Techniques in Claude Code?

Run `npx skills add zhaji2333/CkSKILLS --skill waf-bypass-techniques -a claude-code`. Or copy the skill folder (.agents/skills/waf-bypass-techniques in zhaji2333/CkSKILLS) into .claude/skills/waf-bypass-techniques in your project. Claude Code loads it when a task matches its description.

How do I install Waf Bypass Techniques in Codex?

Run `npx skills add zhaji2333/CkSKILLS --skill waf-bypass-techniques -a codex`. Or copy the skill folder (.agents/skills/waf-bypass-techniques in zhaji2333/CkSKILLS) into .agents/skills/waf-bypass-techniques in your project. Codex loads it when a task matches its description.

Can I use Waf Bypass Techniques in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add zhaji2333/CkSKILLS --skill waf-bypass-techniques -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/waf-bypass-techniques, .gemini/skills/waf-bypass-techniques, .github/skills/waf-bypass-techniques and .opencode/skills/waf-bypass-techniques in your project.

What does Waf Bypass Techniques need to run?

SKILL.md names no scripts, command-line tools or credentials: Waf Bypass Techniques is instructions for the agent only.

Does Waf Bypass Techniques access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Waf Bypass Techniques safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Waf Bypass Techniques use?

Waf Bypass Techniques is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Waf Bypass Techniques use?

About 620 tokens (SKILL.md is roughly 2.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Waf Bypass Techniques?

Skills that share tags, products or a category with Waf Bypass Techniques: Security And Hardening (penpot/penpot, 61k stars), Security Auditor (eigent-ai/eigent, 15k stars), Security Review (jewbetcha/opentrace, 116 stars) and Strix Code Vulnerability Scan (usestrix/strix, 68k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Waf Bypass Techniques?

zhaji2333 (a GitHub user) maintains it in zhaji2333/CkSKILLS, which has 115 GitHub stars. The repository holds 15 skills in this directory. The repository was last updated on September 15, 2026.

Source: zhaji2333/CkSKILLS on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Waf Bypass Techniques

Facts

At a glance

What it does

When your agent uses it

Example prompts

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

waf-bypass-techniques — 绕过与对抗专项深度挖掘

何时调用（触发条件）

一、对抗意识框架（先定位再绕过）

二、失败升级路径（Level 1-7）

三、通用绕过技术库

编码类

变形类

逻辑类

协议类

四、分类绕过速查

SQL 注入绕过

XSS 绕过

命令注入绕过

文件上传绕过

SSRF 绕过

五、403 绕过专项

六、验证要点

七、注意事项

Files

Compare with similar skills

Similar skills

More from zhaji2333/CkSKILLS

Related

Questions about Waf Bypass Techniques