waf-bypass-methodology

SUSPICIOUS. The skill is internally consistent and does not show credential harvesting, hidden installs, or third-party interception, but its stated purpose is to help an AI agent evade WAF protections and conduct offensive web exploitation. Risk is driven by enabling active attack behavior, not by malware-like exfiltration or supply-chain abuse.

该片段是描述 HTTP/WAF 绕过、注入和请求走私测试方法的安全研究文档，不是包含恶意运行时行为的软件代码。它没有直接执行攻击或窃取数据，但所提供的示例可用于未授权攻击，且涉及高风险请求走私和权限操作测试。应仅在明确授权的测试环境中使用，并确保 WAF、代理和后端采用一致的 HTTP 解析与严格的输入验证。