File Access Vuln

This is a routing skill that helps you figure out whether a file-related vulnerability is path traversal or upload validation. When you're testing download endpoints, upload flows, file previews, or archive extraction, it pushes you toward one of two deeper skills: path-traversal-lfi for read-side issues like LFI and wrapper abuse, or upload-insecure-files for validation bypasses and processing chain attacks. The core value is forcing you to categorize early instead of thrashing between techniques. It's lightweight by design, no payloads here, just triage logic to get you into the right workflow faster.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill file-access-vuln --agent claude-code

Installs into .claude/skills of the current project.

Files

File Access Router

This is the routing entry point for filesystem paths, download endpoints, upload pipelines, and file preview handling.

When to Use

Parameters, filenames, download endpoints, or import flows influence file paths
The target supports upload, preview, transcoding, extraction, sharing, download, or proxied file access
You need to decide whether this is path traversal/LFI or an upload-validation/processing-chain issue

Skill Map

Path Traversal LFI: path traversal, file read, wrapper abuse, include chains
Upload Insecure Files: upload validation, storage paths, processing chains, overwrite risk, preview/share boundaries

Recommended Flow

First identify whether the entry point is a path parameter, download endpoint, or upload workflow
Then locate whether the issue appears in accept, store, process, or serve stages
Small path-chain and upload-bypass samples are merged into the main topic skills; no separate payload entry is needed