What problem does it solve? Golden files and envoy --mode validate only prove a generated firewall config is valid, not that it behaves correctly at runtime. This Skill closes that gap by running live egress probes from inside a clawker agent container whose traffic flows through the real firewall stack (eBPF redirect, Envoy, CoreDNS), catching contract regressions that static validation misses. ## Core Features & Use Cases - Live egress probing: Exercise HTTP, HTTPS, SSH, WebSocket, and DNS egress with in-container tools (curl, ssh, nghttp, h2load, websocat, openssl, gh) to confirm allow/deny behavior against the live Envoy and CoreDNS layers. - Behavioral discriminators: Distinguish DNS-layer blocks (NXDOMAIN), clawker path denies (403 with Forbidden body), Envoy upgrade refusals (empty-body 403), and true upstream reachability using a hard-won observation table. - Adversarial C2 testing: Probe a ngrok-exposed C2 host to verify exfiltration blocks on non-allowlisted hosts, paths, and protocols. - Use Case: After changing the controlplane firewall generator, ask the host operator to add or remove rules with clawker firewall add, then re-probe from inside the container to prove the new rules actually block or allow traffic before declaring the work done. ## Quick Start Run the firewall UAT probes from this container to verify the current egress rules behave as configured.
