realad/waf-testing ? reverse-engineered prompt

Build me a lightweight WAF testing toolkit that I can use as a template for my own projects.

I want a simple shell based script that can quickly check whether a website or API is really blocking common attack attempts like SQL injection, XSS, path traversal, SSRF, and a few other common payloads. It should run fast, work on Linux, macOS, and Windows through Git Bash, and accept a target URL plus optional custom headers. If I pass in a URL with a FUZZ placeholder, it should test that spot, otherwise it can use a default query parameter.

Please also make it generate a clear Markdown report with a score and short recommendations, especially for AWS WAF and Cloudflare. I’d like a GitHub Actions workflow too, so I can set a WAF_TEST_URL secret, run it manually, or have it run on a schedule. Keep it easy to customize, clean, and safe to use on staging or production with care.