How does the --depth deep flag change the analysis?

The deep flag triggers a comprehensive trace of the entire file lifecycle, following the path from the initial upload handler through storage mechanisms to the final serving configuration.

What specific vulnerabilities does this skill detect?

It identifies CWE-434 (unrestricted upload of dangerous file types), CWE-22 (path traversal), Zip Slip vulnerabilities, missing magic byte validation, and insecure storage in web-accessible directories.

Does it require external scanners to work?

While it integrates with Semgrep, Bandit, and Brakeman for enhanced results, it can perform manual code analysis and grep-based detection as a fallback when scanners are unavailable.

Is it compatible with multiple programming languages?

Yes, it uses both language-agnostic patterns and framework-specific scanners like Bandit for Python and Brakeman for Rails to ensure broad coverage across different tech stacks.

Can this skill help fix the security issues it finds?

Yes, it generates detailed findings that include the exact file location, an attack scenario, and concrete code fixes with diffs to remediate the identified gaps.

File Upload Security Auditor

Name: File Upload Security Auditor
Author: florianbuetow

byflorianbuetow

•

セキュリティとテスト

Secures applications by identifying file upload vulnerabilities like path traversal, zip slip, and missing server-side validation.

The File Upload Security skill provides comprehensive automated and manual code analysis to identify critical vulnerabilities in how applications handle file uploads. By checking for common exploits such as path traversal, Zip Slip, missing magic byte verification, and client-side-only validation, it helps developers prevent remote code execution and unauthorized data access. The skill integrates with industry-standard scanners like Semgrep and Bandit while providing deep architectural tracing to ensure uploaded files are stored and served securely.

主な機能

01Detects Path Traversal and Zip Slip vulnerabilities in archive extraction.

02Traces file paths from upload through storage to serving for deep analysis.

03Integrates with Semgrep, Bandit, and Brakeman for automated scanning.

04Verifies server-side content-type and magic byte validation logic.

056 GitHub stars

06Identifies insecure storage locations and execution risks in webroots.

ユースケース

01Implementing robust server-side validation for a new media processing feature.

02Auditing a legacy codebase for file upload vulnerabilities before a production release.

03Remediating CWE-434 and CWE-22 issues identified during a security pentest.

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add florianbuetow/claude-code file-upload

For use in Claude.ai and ChatGPT

Download Skill