# Build Secure File Upload Workflows

Unsafe uploads can expose systems, exhaust resources, and leak private files. This skill provides practical patterns for validation, storage, and scalable transfer workflows.

## Install

```bash
npx skillstore add sickn33/file-uploads
```

## Metadata

- Status: approved
- Slug: sickn33-file-uploads
- Skillstore revision: r2
- Version status: missing
- Tree hash: 0cece65f00589c267b757d996102edbf852bce2c2475988e23586fd919ab8e78
- Author: sickn33
- GitHub username: sickn33
- License: MIT
- Repository: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/file-uploads
- Ref: 88a8e9a07f4c54ab105c1c41b6267c287146b07b
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: filesystem
- Quality score: 78
- Quality tier: bronze
- Public page: https://skillstore.pages.dev/skills/sickn33-file-uploads
- Manifest: https://skillstore.pages.dev/api/skills/sickn33-file-uploads/manifest

## Capabilities

- Explains MIME validation with magic-byte detection instead of trusting extensions or client headers.
- Shows server and client upload size limits that reduce memory, disk, and storage abuse.
- Prevents path traversal by removing path components, restricting extensions, and generating unique filenames.
- Recommends short-lived presigned URLs and no-store response headers for private files.
- Guides direct and streamed upload designs that avoid buffering large files on application servers.

## Use Cases

- Secure an Upload Endpoint: Review validation, size limits, filename handling, and response behavior for a web application upload endpoint.
- Design Direct Cloud Uploads: Plan presigned uploads to S3 or R2 while controlling object names, file sizes, expiry, and caching.
- Audit Upload Threats: Identify file spoofing, path traversal, denial-of-service, and private URL exposure in an existing upload flow.

## Prompt Templates

### Check Basic Upload Safety

```
Review this upload requirement: {requirement}. Recommend allowed file types, a size limit, and safe filename handling.
```

### Review an Upload Endpoint

```
Review this upload endpoint: {implementation}. Identify weak validation, buffering, path traversal, and unsafe content serving. Suggest specific fixes.
```

### Design a Presigned Upload Flow

```
Design a presigned upload flow for {provider} and {file_types}. Include authorization, object keys, size enforcement, expiry, caching, and post-upload validation.
```

### Threat Model a Large Upload System

```
Threat model this multipart upload architecture: {architecture}. Cover abuse cases, resource limits, private access, validation stages, failure recovery, and monitoring controls.
```

## Limitations

- Provides implementation guidance but does not execute uploads, configure cloud accounts, or deploy infrastructure.
- Uses JavaScript and TypeScript examples that require adaptation for other languages and frameworks.
- Does not provide a complete IAM policy, malware scanner, or storage lifecycle configuration.
- Mentions image optimization but does not include a complete optimization pipeline.

## Best Practices

- Validate actual file signatures, size, and authorization before making an uploaded object available.
- Generate storage keys on the server and keep original filenames as untrusted display metadata.
- Use short expiry periods, private storage defaults, and non-cacheable responses for sensitive signed URLs.

## Anti Patterns

- Do not trust filename extensions or client-provided content types as proof of file format.
- Do not buffer large uploads in application memory or accept uploads without enforced size limits.
- Do not concatenate user filenames into filesystem paths or public object keys.

## Security Audit

- Audited at: 2026-07-23T22:10:51.163\+00:00
- Summary: All four static findings are false positives caused by defensive examples that explain upload threats and their mitigations. No malicious intent, system access, reconnaissance, or prompt injection was found.

## Stats

- Views: 107
- Downloads: 10
- Favorites: 0
- Popularity score: 0