From appsec
This skill should be used when the user asks to "check file upload security", "analyze upload validation", "find upload vulnerabilities", "check for zip slip", "audit file upload handling", or mentions "file upload", "upload validation", "content-type check", "magic bytes", "zip slip", or "path traversal in upload" in a security context.
npx claudepluginhub florianbuetow/claude-code --plugin appsecThis skill uses the workspace's default tool permissions.
Analyze source code for file upload vulnerabilities including client-only
Acquire memory dumps from live systems/VMs and analyze with Volatility 3 for processes, networks, DLLs, injections in incident response or malware hunts.
Provides x86-64/ARM disassembly patterns, calling conventions, control flow recognition for static analysis of executables and compiled binaries.
Identifies anti-debugging checks like IsDebuggerPresent, NtQueryInformationProcess in Windows binaries; suggests bypasses via patches/hooks/scripts for malware analysis, CTFs, authorized RE.
Analyze source code for file upload vulnerabilities including client-only validation, missing content-type verification, no magic byte checking, path traversal in filenames, upload to webroot with execution, and zip slip (archive extraction path traversal). Insecure file uploads can lead to remote code execution, denial of service, and data exfiltration.
Read ../../shared/schemas/flags.md for the full flag specification. This skill
supports all cross-cutting flags. Key flags for this skill:
--scope determines which files to analyze (default: changed)--depth standard reads code and checks upload handlers--depth deep traces file paths from upload through storage to serving--severity filters output (upload issues are often critical or high)Key CWEs in scope:
Read references/detection-patterns.md for the full catalog of code patterns,
search heuristics, language-specific examples, and false positive guidance.
Parse flags and resolve the file list per ../../shared/schemas/flags.md.
Filter to files likely to contain upload logic:
**/upload/**, **/uploads/**, **/attachments/**)**/files/**, **/media/**, **/storage/**)**/middleware/**, **/controllers/**)**/extract/**, **/unzip/**, **/import/**)**/components/**, **/views/**)Detect scanners per ../../shared/schemas/scanners.md:
semgrep -- primary scanner for upload patternsbandit -- Python file handling issuesbrakeman -- Rails file upload vulnerabilitiesRecord which scanners are available and which are missing.
If semgrep is available, run with rules targeting upload security:
semgrep scan --config auto --json --quiet <target>
Filter results to rules matching file upload, path traversal, and content-type patterns. Normalize output to the findings schema.
Regardless of scanner availability, perform manual code analysis:
accept
attribute, JavaScript validation) without corresponding server-side checks.When --depth deep, additionally trace:
Format output per ../../shared/schemas/findings.md using the UPLD prefix
(e.g., UPLD-001, UPLD-002).
Include for each finding:
These are the high-signal patterns specific to file upload security. Each
maps to a detection pattern in references/detection-patterns.md.
Client-only file type validation -- HTML accept attribute or JavaScript
checks without server-side enforcement.
Missing content-type verification -- Upload handler accepts any file type or trusts the client-provided Content-Type header.
No magic byte validation -- File type determined solely by extension or Content-Type, not by reading the file header bytes.
Path traversal in filename -- Original filename used in path construction
(e.g., ../../../etc/passwd) without sanitization.
Upload to executable directory -- Files stored in webroot where a server
could execute uploaded scripts (.php, .jsp, .py).
Zip slip vulnerability -- Archive extraction writes files outside the
intended directory via ../ entries in archive member paths.
Missing file size limit -- No server-side limit on upload size, enabling denial of service via large files.
Dangerous file types allowed -- No blocklist for executable file types
(.exe, .sh, .php, .jsp, .py).
| Scanner | Coverage | Command |
|---|---|---|
| semgrep | Path traversal, unrestricted upload, zip slip | semgrep scan --config auto --json --quiet <target> |
| bandit | Python file handling, path traversal | bandit -r <target> -f json -q |
| brakeman | Rails file upload, content type | brakeman -q -f json -o /dev/stdout |
Fallback (no scanner): Use Grep with patterns from references/detection-patterns.md
to find upload handlers, filename usage, archive extraction, and content-type
checks. Report findings with confidence: medium.
Use the findings schema from ../../shared/schemas/findings.md.
UPLD (e.g., UPLD-001)file-uploadspecializedUPLDCWE-434, CWE-22A04:2021 (Insecure Design)T (Tampering) or E (Elevation of Privilege)Severity guidance for this category: