Skills file-uploads
📦

file-uploads

Content revision r2 Safe 📁 Filesystem access

Build Secure File Upload Workflows

Unsafe uploads can expose systems, exhaust resources, and leak private files. This skill provides practical patterns for validation, storage, and scalable transfer workflows.

Supports: Claude Codex Code(CC)
🥉 78 Bronze

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "file-uploads" from https://skillstore.io/skills/sickn33-file-uploads.md and its manifest at https://skillstore.io/api/skills/sickn33-file-uploads/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-file-uploads.md Signed manifest GET /api/skills/sickn33-file-uploads/manifest Signed lockfile GET /api/skills/sickn33-file-uploads/lockfile

Test it

Using "file-uploads". Review an image upload endpoint that checks only the filename extension.

Expected outcome:

  • Critical issue: extensions and client content types can be forged.
  • Detect the actual format from file signatures and allow only approved MIME types.
  • Generate a new storage name and serve the object with the validated content type.

Using "file-uploads". Design uploads for videos up to five gigabytes without routing bytes through the application server.

Expected outcome:

  • Use authorized, short-lived multipart upload URLs for direct cloud transfer.
  • Bind object keys and expected sizes to the authenticated user and upload record.
  • Validate the completed object before publication and remove abandoned multipart uploads.

Using "file-uploads". Assess how a private download URL should be returned from an API.

Expected outcome:

Return a short-lived signed URL only after authorization. Mark the API response as non-cacheable and avoid logging or sharing the URL.

Security Audit

Safe
v5 • 7/23/2026 Open versioned report

All four static findings are false positives caused by defensive examples that explain upload threats and their mitigations. No malicious intent, system access, reconnaissance, or prompt injection was found.

1
Files scanned
233
Lines analyzed
0
Review items
0
False positives ignored

Risk Factors

📁 Filesystem access (1)
SKILL.md:118
No confirmed security findings were detected by the latest completed static and semantic audit. This does not prove the skill has no side effects.
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/sickn33-file-uploads/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-file-uploads/security.svg)](https://skillstore.io/skills/sickn33-file-uploads?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-file-uploads?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-file-uploads/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-file-uploads.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). file-uploads security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-file-uploads/audits/5

BibTeX citation

@techreport{sickn33-sickn33-file-uploads-2026, author = {sickn33}, title = {file-uploads security audit report (audit version 5)}, institution = {Skillstore}, year = {2026}, number = {5}, url = {https://skillstore.io/skills/sickn33-file-uploads/audits/5}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "file-uploads security audit report (audit version 5)" version: "unspecified" type: report authors: - name: "sickn33" date-released: "2026-07-23" url: "https://skillstore.io/skills/sickn33-file-uploads/audits/5" identifiers: - type: other value: "skillstore:sickn33-file-uploads:audit:5" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High
55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance

What You Can Build

Secure an Upload Endpoint

Review validation, size limits, filename handling, and response behavior for a web application upload endpoint.

Design Direct Cloud Uploads

Plan presigned uploads to S3 or R2 while controlling object names, file sizes, expiry, and caching.

Audit Upload Threats

Identify file spoofing, path traversal, denial-of-service, and private URL exposure in an existing upload flow.

Try These Prompts

Check Basic Upload Safety 
Review this upload requirement: {requirement}. Recommend allowed file types, a size limit, and safe filename handling.
Review an Upload Endpoint 
Review this upload endpoint: {implementation}. Identify weak validation, buffering, path traversal, and unsafe content serving. Suggest specific fixes.
Design a Presigned Upload Flow 
Design a presigned upload flow for {provider} and {file_types}. Include authorization, object keys, size enforcement, expiry, caching, and post-upload validation.
Threat Model a Large Upload System 
Threat model this multipart upload architecture: {architecture}. Cover abuse cases, resource limits, private access, validation stages, failure recovery, and monitoring controls.

Best Practices

  • Validate actual file signatures, size, and authorization before making an uploaded object available.
  • Generate storage keys on the server and keep original filenames as untrusted display metadata.
  • Use short expiry periods, private storage defaults, and non-cacheable responses for sensitive signed URLs.

Avoid

  • Do not trust filename extensions or client-provided content types as proof of file format.
  • Do not buffer large uploads in application memory or accept uploads without enforced size limits.
  • Do not concatenate user filenames into filesystem paths or public object keys.

Frequently Asked Questions

Does this skill upload files for me?
No. It provides design and review guidance for implementing file upload and storage workflows.
Which storage services does it cover?
It addresses patterns for Amazon S3 and Cloudflare R2, especially direct uploads and signed URLs.
Why are filename extensions insufficient?
Attackers can rename files or forge content headers. Verify the format from file signatures and enforce an allowlist.
How should large files be handled?
Stream data or use direct multipart cloud uploads. Enforce size limits without buffering the full file in application memory.
How does it prevent path traversal?
It recommends removing path components, allowing limited extensions, and generating new server-controlled filenames.
Does it replace a security review?
No. Validate the final implementation, permissions, provider settings, and threat controls in the target environment.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/file-uploads

Ref

88a8e9a07f4c54ab105c1c41b6267c287146b07b

Maintenance freshness

7/26/2026

Usage

7 downloads · 107 views

File structure

📄 SKILL.md

More from sickn33

View all

Related Skills

View all