imperva-waf-reese84

Stars9

Forks1

UpdatedJuly 8, 2026 at 04:04

Conditional escalation skill for confirmed Imperva/Incapsula/Reese84 work. Use only when the user explicitly names 84盾, Reese84, Incapsula, Imperva, x-d-token, reese84 cookie, or when current evidence shows Reese84/Incapsula markers such as SWJIYLWA/CWUDNSAI/SWUDNSAI challenge HTML or protected business API rejection tied to those markers. It records token identity, WAF acceptance evidence, and backend acceptance boundaries. Do not trigger for generic anti-bot, generic fingerprint, ordinary sign/token, Cloudflare/Akamai/DataDome, or crawler delivery without Imperva/Reese84 evidence.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Source

zy950618

zy950618/oh_my_reverse_skill

View GitHub Repository View Creator Repositories

Download

Related occupationsSOC

Based on SOC occupation classification

Software DevelopersComputer and Mathematical Occupations·SOC 15-1252

File Explorer

9 files

SKILL.md

readonly

name	imperva-waf-reese84
standard_type	conditional_escalation
description	Conditional escalation skill for confirmed Imperva/Incapsula/Reese84 work. Use only when the user explicitly names 84盾, Reese84, Incapsula, Imperva, x-d-token, reese84 cookie, or when current evidence shows Reese84/Incapsula markers such as SWJIYLWA/CWUDNSAI/SWUDNSAI challenge HTML or protected business API rejection tied to those markers. It records token identity, WAF acceptance evidence, and backend acceptance boundaries. Do not trigger for generic anti-bot, generic fingerprint, ordinary sign/token, Cloudflare/Akamai/DataDome, or crawler delivery without Imperva/Reese84 evidence.
platforms	["web","h5"]

Imperva WAF Reese84

Do NOT Trigger When

目标网站的反爬不是 Imperva 系（Akamai / Cloudflare / Datadome / PerimeterX / Shape / kasada 等都不是本 skill 范围）→ 这类需另起 skill 或走通用 reverse-js-crawler
用户只问普通 sign/token/cookie 生成（无 challenge HTML、无 Reese84 cookie、无 x-d-token、无 _Incapsula_Resource 标记） → 切到 reverse-js-crawler
用户要求"完整 FastAPI 接口测试交付"、314 接入请求或本地基础框架接入 → 切到 website-314-api-delivery（让它做总控，本 skill 只处理 WAF 子链）
用户做的不是 Web/H5 网站 WAF 链路 → 不属于本仓库范围
用户只要"评估 WAF skill 本身好不好" → 切到 skills-evaluation-governance

Purpose

处理 WAF/Reese84 时必须区分三件事：本地能生成 token、挑战端点返回 token、业务接口真正接受请求。只有第三个才算成功。

Workflow

识别保护类型和分类：
- 403/429
- text/html but expected JSON
- x-iinfo
- _Incapsula_Resource
- SWJIYLWA, CWUDNSAI, SWUDNSAI
- Pardon Our Interruption
抽取官方 challenge：
- 从 HTML 中提取当前脚本 URL。
- 不手写 token 格式，优先运行官方 challenge JS。
- 记录 challenge host、cookie domain、script path、post endpoint。
补浏览器环境：
- 进入补环境工作前先 Read ~/.claude/skills/env-patch/SKILL.md，拿到补环境引擎、proxy 模式、存根策略，再开始写代码。
- 模拟 window/document/navigator/location/screen/performance/crypto 等依赖。
- 对齐 UA、client hints、language、timezone、screen、hardware、referer、origin、sec-fetch。
- 浏览器只用于诊断或显式 fallback，不依赖用户真实浏览器缓存。
按身份缓存：
- cache key 至少包括 proxy/IP、UA、client hints、market、host/domain、session scope。
- 不跨并发用户共享一个浏览器 session 或 cookie jar。
- 遇到 WAF HTML、403、x-iinfo、challenge marker 强制刷新。
验证接受度：
- token 生成后必须请求目标业务接口。
- 如果业务接口仍然返回 challenge，返回保护失败和诊断，不伪造业务成功。

Success Criteria

已证明 challenge token/cookie 生成。
已证明目标业务接口是否接受该 token/cookie。
已区分 WAF、路由错误、payload 错误、IP/proxy 和业务无数据。
已记录 cache key、刷新原因和重试边界。
已把测试失败写入站点经验库或 eval backlog。

Tool Policy

开始实现前 Read ~/.claude/skills/karpathy-guidelines/SKILL.md,确认 4 条原则:Think Before Coding / Simplicity First / Surgical Changes / Goal-Driven Execution。这是基础层规范,所有执行类 skill 强制依赖。
遇到逆向运行时问题(断点/时间/cookie/TLS 指纹/风控恢复/接口变更)Read ~/.claude/skills/oh_my_reverse_skill/99-SKILLS治理/10-逆向运行时常见问题.md。
输出结论、扩范围或做并发前 Read ~/.claude/skills/oh_my_reverse_skill/99-SKILLS治理/11-AI事实证据规约.md / 12-反泛化与任务收敛规约.md / 13-并发指纹与会话隔离规约.md。
改端点/字段/状态/保护/实现/eval 前后 Read 14-知识图谱行程与关联规约.md / 15-AI变更风险与回归校验规约.md,并更新 knowledge-graph.md / impact-regression.md。

Boundaries

这是反爬/WAF Skill，不是普通采集 Skill。
不把普通 sign/token 任务都升级成 WAF 处理。
不把代码工程风格规则放进这里；后续 AGENT 处理编码规则。

Governance

If the user asks for full website-to-service delivery, FastAPI interface test delivery, optional local base framework integration such as 314, search/cart/order/payment stages, or long-term API service output, use website-314-api-delivery as the orchestrator and use this skill only for WAF/anti-bot parts.

Version: 0.2.0
Status: scorecard baseline
Site memory: write WAF markers and stage-specific failures to 站点经验库/<domain>/.
Backtest: include token-not-accepted, cache identity, browser policy, and negative basic-sign regression evals.
CI: use Skill Bench or local backtest; quick_validate must pass before accepting changes.

References

references/architecture.md: 隔离 anti-bot、business service、reverse runtime。
references/testing.md: WAF token 接受度测试。
references/governance.md: versioning, change log, Skill Bench, GitHub CI, quick_validate, and drift-test policy.

More from this repository

same repository

skills-evaluation-governance

zy950618/oh_my_reverse_skill

Use this skill to score, refine, backtest, and govern Codex/Claude skills: assess whether notes are installable skills, create evals, prepare Skill Bench structure, compare SKILL.md quality, define trigger/negative-trigger tests, track drift, maintain versions, record changes, and enforce admission gates for new Skills. Trigger when the user asks to rate skills, use Skill Bench, convert notes into usable skills, evaluate trigger accuracy, maintain a skills library, score a new Skill before accepting it, run backtests, or Chinese requests such as SKILLS评分, 技能评分, 可用SKILLS, 新增Skill准入, Skill Bench跑分, 回测, 漂移测试, 长期治理, 版本号, 变更记录, 触发词优化, 负例测试, or 技能库治理.

2026-07-129

web-h5-loop-engineering

zy950618/oh_my_reverse_skill

Orchestration entry for Web/H5 reverse-engineering work only when the user explicitly asks for LOOP, closed-loop handling, multi-agent/three-role verification, repeated validation, execution ledger, acceptance report, or when a prior attempt failed because evidence, repeat verification, cleanup, impact, or backend acceptance was incomplete. It coordinates executor, verifier, and governor roles with loop ledger, acceptance report, fixture freshness, and metrics. Do not trigger for ordinary one-pass crawler tasks, simple fixture freshness checks, or single-tool JS work; use reverse-js-crawler or the relevant support tool first.

2026-07-129

find-crypto-entry

zy950618/oh_my_reverse_skill

Internal/support tool for locating the JS source of one concrete encrypted request field, sign, x-sign, authKey, or token. Use directly only when the user explicitly asks for an atomic entry-location task such as "找加密入口", "签名怎么算", or "这个请求头字段哪里生成"; otherwise let reverse-js-crawler or website-314-api-delivery choose it. Do not trigger for generic crawler delivery, ordinary request inspection, challenge/WAF backend acceptance, or non-encrypted parameters.

2026-07-129

env-patch

zy950618/oh_my_reverse_skill

Internal/support tool for running a previously identified browser encryption module in Node.js with env_core.js, prototype/native-function shims, and minimal stubs. Use directly only when the user explicitly asks for 补环境, Node里跑, webpack模块提取, or when an entry skill has already located the module and needs browser-to-Node reproduction. Do not trigger for ordinary browser debugging, AST deobfuscation, generic Node.js code, crawler delivery, or unresolved API discovery.

2026-07-099

js-page-runtime-parity

zy950618/oh_my_reverse_skill

Extract page-level JavaScript runtime dependencies and verify Browser, Node, V8, and PageRuntime output parity for authorized targets or localhost labs without generating risk tokens or defeat behavior.

2026-07-099

authorized-target-adapter

zy950618/oh_my_reverse_skill

Adapt reverse-engineering workflows only for owned or explicitly authorized targets with scope, allowed hosts, rate limits, stop conditions, redaction, and business data assertions.

2026-07-089