Skip to content
Security
Skill

/file-access-vuln

Entry P1 category router for file access and upload workflows. Use when testing download endpoints, file paths, local file inclusion, upload flows, preview pipelines, archive extraction, or storage and sharing boundaries.

BOOST
@yaklangyaklang@yaklang
From plugin
hack-skills
2.7k103 skills

Claude Code

$ npx -y skills add yaklang/hack-skills --skill file-access-vuln --agent claude-code

SKILL.md

file-access-vuln.SKILL.md
name: file-access-vuln
description: >-
  Entry P1 category router for file access and upload workflows. Use when
  testing download endpoints, file paths, local file inclusion, upload flows,
  preview pipelines, archive extraction, or storage and sharing boundaries.

File Access Router

This is the routing entry point for filesystem paths, download endpoints, upload pipelines, and file preview handling.

When to Use

  • Parameters, filenames, download endpoints, or import flows influence file paths
  • The target supports upload, preview, transcoding, extraction, sharing, download, or proxied file access
  • You need to decide whether this is path traversal/LFI or an upload-validation/processing-chain issue

Skill Map

  • [Path Traversal LFI](../path-traversal-lfi/SKILL.md): path traversal, file read, wrapper abuse, include chains
  • [Upload Insecure Files](../upload-insecure-files/SKILL.md): upload validation, storage paths, processing chains, overwrite risk, preview/share boundaries

Recommended Flow

1. First identify whether the entry point is a path parameter, download endpoint, or upload workflow 2. Then locate whether the issue appears in accept, store, process, or serve stages 3. Small path-chain and upload-bypass samples are merged into the main topic skills; no separate payload entry is needed

Related Categories

  • [injection-checking](../injection-checking/SKILL.md)
  • [business-logic-vuln](../business-logic-vuln/SKILL.md)
Read more
Read it on GitHub ↗
Stats
PythonJavaScriptNodeHTMLJavaPHPSQLGraphQLKubernetesLinuxiOSAndroid
2,643
Stars
367
Forks
Maintained
Maintenance
CSS
Language
MIT
License
Last commit
Created

Repo: yaklang/hack-skills

In this plugin
103 skills
See everything inside
@yaklang
Ships withhack-skills

Master Entry → Category Entries → Deep Topic Skills One master entry, six category entries, and 102 deep topic skills across 14 security domains.

2.7k103 skills
Get the whole plugin

Stars on GitHub

Momentum

stars in total
2.7k
Star history of yaklang/hack-skills on GitHub, a chart by star-history.com
See what's trending this week

Other skills on hack-skills.

ai-ml-security

ai-ml-security

AI/ML security playbook. Use when assessing model supply chain attacks (pickle RCE, poisoned weights), adversarial examples,…

hack-skills
@yaklang@yaklangInstall Skill
See all 103 skills in hack-skills

More skills from other plugins.

api-security

api-security

Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…

reverse-skill7w44k
@zhaoxuya520@zhaoxuya520Install Skill
nemoclaw-user-guide

nemoclaw-user-guide

Find official NemoClaw documentation for installation, configuration, operation, or troubleshooting. Also handles requested docs…

nemoclaw2w23k
@nvidia@nvidiaInstall Skill

Questions about file-access-vuln.

Which coding agents can use file-access-vuln?
file-access-vuln installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.