waf-validator-skills

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only WAF testing skill whose risky traffic is disclosed and aligned with its purpose, but it should only be used on authorized targets.

Install this only if you need WAF validation. Run it only against systems you own or are explicitly authorized to test, preferably in a controlled environment. Verify the GoTestWAF source or Docker image, keep reports local unless intentionally sharing them, and set target and concurrency carefully.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The trigger list is broad enough that the skill may activate on generic terms like 'security' or 'testing', causing the agent to invoke a capability that generates malicious WAF test traffic in contexts the user may not intend. In a security-testing skill, accidental activation is more dangerous because the workflow includes offensive scanning guidance and payload generation against targets.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal