file-uploads
Build Secure File Upload Workflows
Unsafe uploads can expose systems, exhaust resources, and leak private files. This skill provides practical patterns for validation, storage, and scalable transfer workflows.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "file-uploads" from https://skillstore.io/skills/sickn33-file-uploads.md and its manifest at https://skillstore.io/api/skills/sickn33-file-uploads/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "file-uploads". Review an image upload endpoint that checks only the filename extension.
Expected outcome:
- Critical issue: extensions and client content types can be forged.
- Detect the actual format from file signatures and allow only approved MIME types.
- Generate a new storage name and serve the object with the validated content type.
Using "file-uploads". Design uploads for videos up to five gigabytes without routing bytes through the application server.
Expected outcome:
- Use authorized, short-lived multipart upload URLs for direct cloud transfer.
- Bind object keys and expected sizes to the authenticated user and upload record.
- Validate the completed object before publication and remove abandoned multipart uploads.
Using "file-uploads". Assess how a private download URL should be returned from an API.
Expected outcome:
Return a short-lived signed URL only after authorization. Mark the API response as non-cacheable and avoid logging or sharing the URL.
Security Audit
SafeAll four static findings are false positives caused by defensive examples that explain upload threats and their mitigations. No malicious intent, system access, reconnaissance, or prompt injection was found.
Risk Factors
📁 Filesystem access (1)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-file-uploads/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-file-uploads?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-file-uploads?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-file-uploads/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-file-uploads.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). file-uploads security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-file-uploads/audits/5BibTeX citation
@techreport{sickn33-sickn33-file-uploads-2026,
author = {sickn33},
title = {file-uploads security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-file-uploads/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "file-uploads security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/sickn33-file-uploads/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-file-uploads:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: HighWhat You Can Build
Secure an Upload Endpoint
Review validation, size limits, filename handling, and response behavior for a web application upload endpoint.
Design Direct Cloud Uploads
Plan presigned uploads to S3 or R2 while controlling object names, file sizes, expiry, and caching.
Audit Upload Threats
Identify file spoofing, path traversal, denial-of-service, and private URL exposure in an existing upload flow.
Try These Prompts
Review this upload requirement: {requirement}. Recommend allowed file types, a size limit, and safe filename handling.Review this upload endpoint: {implementation}. Identify weak validation, buffering, path traversal, and unsafe content serving. Suggest specific fixes.Design a presigned upload flow for {provider} and {file_types}. Include authorization, object keys, size enforcement, expiry, caching, and post-upload validation.Threat model this multipart upload architecture: {architecture}. Cover abuse cases, resource limits, private access, validation stages, failure recovery, and monitoring controls.Best Practices
- Validate actual file signatures, size, and authorization before making an uploaded object available.
- Generate storage keys on the server and keep original filenames as untrusted display metadata.
- Use short expiry periods, private storage defaults, and non-cacheable responses for sensitive signed URLs.
Avoid
- Do not trust filename extensions or client-provided content types as proof of file format.
- Do not buffer large uploads in application memory or accept uploads without enforced size limits.
- Do not concatenate user filenames into filesystem paths or public object keys.