The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the ModSecurity source code from the official SpiderLabs repository on GitHub and the Core Rule Set from the OWASP Core Rule Set repository. Both are well-known and reputable sources for web application security software.
[REMOTE_CODE_EXECUTION]: Provides instructions to compile ModSecurity from source using a build script and standard build tools (make, configure). While this executes downloaded code, the sources are trusted and the process is standard for Nginx module installation.
[COMMAND_EXECUTION]: Includes various shell commands for infrastructure management, including AWS CLI for WAF deployment, cURL for Cloudflare API interactions, and local shell scripts for log analysis.
[PRIVILEGE_ESCALATION]: The installation instructions include package management commands (apt install) and software installation steps (make install) that typically require administrative privileges. These are necessary and expected for configuring system-level services like Nginx and ModSecurity.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The waf-tune.sh script reads the ModSecurity audit log (/var/log/modsec/modsec_audit.log), which contains data from external HTTP requests such as User-Agents and URIs.
Boundary markers: No explicit boundary markers or delimiters are used in the script's output to separate untrusted log data from other context.
Capability inventory: The skill allows for package installation, compilation of source code, and modification of firewall rules via cloud APIs.
Sanitization: The log data is filtered using grep with specific regular expression patterns to extract rule IDs, IPs, and URIs, which provides basic structural validation of the processed data.
[CREDENTIALS_SAFE]: Cloudflare API authentication is correctly implemented using the ${CF_TOKEN} environment variable, avoiding the risk of hardcoded secrets in the skill instructions.

waf-setup