Individual skill

evo-suricata-custom-exfil

Generates and validates Suricata 7.0 rules for detecting data exfiltration hidden in HTTP telemetry traffic, using sticky buffers, exact URI matching, header inspection, and PCRE body pattern matching.

tasks-evolved/suricata-custom-exfil/environment/skills/evo-suricata-custom-exfil/SKILL.md

Read pinned source

Source commit 84ca182da055fafb6453dcec4a6defdbbfd987c1

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: Yes
Repository scan complete: No
Skill scan complete: No
Observed behavior: Local scripts
Last checked: Nov 6, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 97
Repository last updated: Sep 10, 2026
License: Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

agent-skills Repository topic
ai-agents Repository topic
llm-agents Repository topic
open-world Repository topic
self-evolving-agents Repository topic
data Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 4,945 bytes
SKILL.mdcore · 4,945 bytes
SKILL.mdcore · 4,945 bytes
scripts/generate_rule.pyruns · 17,877 bytes

Read excerpt


# evo-suricata-custom-exfil

## Description
Generates Suricata 7.0 rules for detecting data exfiltration hidden in HTTP telemetry traffic.
Handles all five detection conditions with proper sticky buffer syntax, URL-decode transforms,
parameter boundary awareness, and PCRE anchoring to minimize false positives and false negatives.

## Domain Knowledge

### Suricata 7.0 Rule Structure
- Header: `alert http any any -> any any` — use `alert http` to leverage Application Layer
  Protocol Identification (ALPI); avoids port-dependent matching.
- Use `any any -> any any` when both source and destination may be internal (e.g., 10.x to 10.x).
- Options in parentheses, semicolon-delimited.