Skip to content
Security
Skill

/file-access-vuln

Entry P1 category router for file access and upload workflows. Use when testing download endpoints, file paths, local file inclusion, upload flows, preview pipelines, archive extraction, or storage and sharing boundaries.

Boost this skill
@yaklangyaklang@yaklang
From plugin
hack-skills
2.2k103 skills
Install
$ npx -y skills add yaklang/hack-skills --skill file-access-vuln --agent claude-code

How it fires

How this skill gets triggered: by you, by Claude, or both.

  • Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.Auto-invocation is when the right skill fires by itself at the right moment, driven by a FLOW.md router and a hook, instead of you invoking it by name. It is the difference between a skill being installed and a skill actually getting used.Read the full definition →
  • You can call itInvoke it directly when you want it.
  • Slash command/file-access-vuln

Context preview

The summary Claude sees to decide when to auto-load this skill.

Entry P1 category router for file access and upload workflows. Use when testing download endpoints, file paths, local file inclusion, upload flows, preview pipelines, archive extraction, or storage and sharing boundaries.

SKILL.md

file-access-vuln.SKILL.md
name: file-access-vuln
description: >-
  Entry P1 category router for file access and upload workflows. Use when
  testing download endpoints, file paths, local file inclusion, upload flows,
  preview pipelines, archive extraction, or storage and sharing boundaries.

File Access Router

This is the routing entry point for filesystem paths, download endpoints, upload pipelines, and file preview handling.

When to Use

  • Parameters, filenames, download endpoints, or import flows influence file paths
  • The target supports upload, preview, transcoding, extraction, sharing, download, or proxied file access
  • You need to decide whether this is path traversal/LFI or an upload-validation/processing-chain issue

Skill Map

  • [Path Traversal LFI](../path-traversal-lfi/SKILL.md): path traversal, file read, wrapper abuse, include chains
  • [Upload Insecure Files](../upload-insecure-files/SKILL.md): upload validation, storage paths, processing chains, overwrite risk, preview/share boundaries

Recommended Flow

1. First identify whether the entry point is a path parameter, download endpoint, or upload workflow 2. Then locate whether the issue appears in accept, store, process, or serve stages 3. Small path-chain and upload-bypass samples are merged into the main topic skills; no separate payload entry is needed

Related Categories

  • [injection-checking](../injection-checking/SKILL.md)
  • [business-logic-vuln](../business-logic-vuln/SKILL.md)
Read more
Read it on GitHub ↗
Ships withhack-skills

Master Entry → Category Entries → Deep Topic Skills One master entry, six category entries, and 102 deep topic skills across 14 security domains.

Get the whole plugin
Stats
PythonJavaScriptNodeHTMLJava
+7 tags
PHPSQLGraphQLKubernetesLinuxiOSAndroid
2,159
Stars
281
Forks
Maintained
Maintenance
CSS
Language
MIT
License
3mo ago
Last commit
5mo ago
Created

Repo: yaklang/hack-skills

In this plugin
103 skills
See everything inside

Other skills on hack-skills.

See all 103 skills in hack-skills