file-upload-testing
A framework for testing and identifying security vulnerabilities in file upload features.
Install
mkdir -p .claude/skills/file-upload-testing && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/4389" && unzip -o skill.zip -d .claude/skills/file-upload-testing && rm skill.zipInstalls to .claude/skills/file-upload-testing
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
文件上传漏洞测试的专业技能和方法论Key capabilities
- →Test for unvalidated file extensions
- →Simulate path traversal attacks
- →Bypass content-type validation
- →Test for race conditions in file uploads
- →Verify server-side file type handling
How it works
It systematically tests file upload endpoints by injecting various file types, manipulating headers, and attempting to bypass extension filters to identify potential code execution vulnerabilities.
Inputs & outputs
When to use file-upload-testing
- →Test file upload for extension bypass
- →Check for path traversal in upload path
- →Simulate race conditions in file handling
- →Verify server-side file type validation
About file-upload-testing
This skill provides a systematic approach to testing file upload security. It covers identifying vulnerabilities like unvalidated extensions, path traversal, content-type spoofing, and race conditions to prevent arbitrary code execution.
文件上传漏洞测试的专业技能和方法论
When not to use it
- →Testing on production environments
- →Unauthorized security assessments
Limitations
- →Only for use in authorized testing environments
- →Requires manual cleanup after testing
How it compares
It automates the application of multiple bypass techniques, which is faster and more consistent than manual testing with Burp Suite.
Compared to similar skills
file-upload-testing side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| file-upload-testing (this skill) | 1 | 6mo | Review | Advanced |
| command-injection-testing | 1 | 6mo | Review | Advanced |
| senior-security | 31 | 7mo | Review | Advanced |
| security-header-generator | 5 | 9mo | Caution | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by Ed1s0nZ
View all by Ed1s0nZ →You might also like
command-injection-testing
Ed1s0nZ
命令注入漏洞测试的专业技能和方法论
senior-security
davila7
Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing. Includes security assessment tools, threat modeling, crypto implementation, and security automation. Use when designing security architecture, conducting penetration tests, implementing cryptography, or performing security audits.
security-header-generator
Dexploarer
Generates security HTTP headers (CSP, HSTS, CORS, etc.) for web applications to prevent common attacks. Use when user asks to "add security headers", "setup CSP", "configure CORS", "secure headers", or "HSTS setup".
backend-security-coder
sickn33
Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.
security-audit
ruvnet
Comprehensive security scanning and vulnerability detection. Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement. Use when: authentication implementation, authorization logic, payment processing, user data handling, API endpoint creation, file upload handling, database queries, external API integration. Skip when: read-only operations on public data, internal development tooling, static documentation, styling changes.
security-best-practices
openai
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.