Does it work with modern PHP frameworks like Laravel or Symfony?

Yes, it analyzes standard PHP file functions and request handling patterns (like $request->input()) commonly used across all major PHP frameworks.

Can it help fix the vulnerabilities it finds?

Absolutely. The skill provides detailed secure code examples, including realpath() validation, basename() usage, and whitelisting strategies to remediate identified risks.

Is this skill aligned with industry security standards?

Yes, the detection patterns and severity classifications are mapped to OWASP A01:2021 (Broken Access Control) and specific CWEs like CWE-22 and CWE-98.

What types of vulnerabilities does this skill detect?

It detects directory traversal, Local File Inclusion (LFI), Remote File Inclusion (RFI), Zip Slip, and insecure file operations like reading, writing, or deleting files using unvalidated user input.

PHP Path Traversal Security Checker

Name: PHP Path Traversal Security Checker
Author: dykyi-roman

bydykyi-roman

•

Security & Testing

Detects and prevents directory traversal vulnerabilities in PHP applications by analyzing risky file operations and input handling.

This skill empowers Claude to perform specialized security audits on PHP codebases, specifically targeting OWASP A01:2021 Path Traversal vulnerabilities. It identifies critical security flaws including Local/Remote File Inclusion (LFI/RFI), insecure file uploads, and Zip Slip vulnerabilities during archive extraction. Beyond just detection, the skill provides automated grep patterns for rapid scanning and offers production-ready remediation patterns—such as realpath() validation, whitelisting, and ID-based file access—to ensure your application's file system remains secure.

Key Features

01Identifies Local and Remote File Inclusion (LFI/RFI) in include/require statements.

0245 GitHub stars

03Provides automated grep patterns for high-speed vulnerability discovery.

04Scans for insecure file operations involving direct user input (GET/POST).

05Suggests secure architectural patterns and input sanitization techniques.

06Detects 'Zip Slip' vulnerabilities in archive extraction logic.

Use Cases

01Automating security checks during the code review process to ensure OWASP compliance.

02Reviewing file upload and image processing modules for path manipulation risks.

03Conducting security audits on legacy PHP applications to identify hidden file system vulnerabilities.

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add dykyi-roman/awesome-claude-code check-path-traversal

For use in Claude.ai and ChatGPT

Download Skill