Individual skill
cloud-armor-crs-rule-upgrader
Upgrades Google Cloud Armor security policies from OWASP CRS 3.0 and 3.3 to OWASP CRS 4.22. Preserves signature opt-in and opt-out lists, translates evaluatePreconfiguredExpr to native evaluatePreconfiguredWaf dictionary parameters, remaps signature IDs to v042200, drops retired signature IDs, and updates structured preconfiguredWafConfig fine-tuning exclusions. Evaluates operational risk (High Breaking Change, Medium Attention Required, Low Clean Upgrade) including Method Enforcement breaking changes (PUT/PATCH/DELETE blocking) and sensitivity coverage expansions. Supports both in-place rule upgrades and smooth preview mode deployments with priority spacing and a 200-rule quota guardrail. Use when a user or agent needs to audit, upgrade, or transition Cloud Armor WAF rules to CRS 4.22. Don't use for non-WAF Cloud Armor rules (IP rate-limiting, geo-blocking, reCAPTCHA) or AWS/Azure WAF migrations.
skills/cloud/cloud-armor-crs-rule-upgrader/SKILL.md
Source commit 496fbede89dac1faf0d180a936bfc472b6fbf886
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 4, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 23,715
- Repository last updated
- Nov 7, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- google Repository topic
- googlecloud Repository topic
- skills Repository topic
- security Derived category
- security-application Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 19,704 bytesSKILL.mdcore · 19,704 bytesSKILL.mdcore · 19,704 bytesSKILL.mdcore · 19,704 bytesSKILL.mdcore · 19,704 bytesSKILL.mdcore · 19,704 bytesSKILL.mdcore · 19,704 bytesSKILL.mdcore · 19,704 bytesreferences/attribution.mddoc · 1,935 bytesreferences/contributing.mddoc · 4,439 bytesreferences/fine_tuning_and_cel.mddoc · 6,813 bytesreferences/gcloud_recipes.mddoc · 8,435 bytesreferences/ruleset_mappings.mddoc · 11,934 bytesscripts/upgrade_policy.pyruns · 35,821 bytes
Read excerpt
# Cloud Armor OWASP Rule Upgrader (CRS 3.0/3.3 -> 4.22)
<!-- disableFinding(LINE_OVER_80) -->
This skill guides Network Security Agents and Google Cloud practitioners through
auditing, assessing, and upgrading Google Cloud Armor security policies from
legacy OWASP Core Rule Set (CRS) 3.0 or 3.3 to OWASP CRS 4.22.
## Usage Attribution
**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you
MUST read and follow the instructions in
[Usage Attribution](references/attribution.md).
