File Access Vuln
- 2.3k installs
- 1.5k repo stars
- Updated June 16, 2026
- yaklang/hack-skills
file-access-vuln is an agent skill router that directs file path, download, and upload testing to traversal LFI or upload validation playbooks.
About
The file-access-vuln skill is a category router for filesystem paths, download endpoints, upload pipelines, and file preview handling during security testing. It triggers when parameters, filenames, download endpoints, or import flows influence file paths, or when targets support upload, preview, transcoding, extraction, sharing, download, or proxied file access. Recommended flow first identifies whether the entry is a path parameter, download endpoint, or upload workflow, then locates whether issues appear in accept, store, process, or serve stages. Skill map routes to path-traversal-lfi for traversal, file read, wrapper abuse, and include chains, or upload-insecure-files for validation, storage paths, processing chains, and preview boundaries. Related categories link injection-checking and business-logic-vuln. Small path-chain and upload-bypass samples live in the main topic skills without separate payload entries. Use when testing download endpoints, file paths, LFI, upload flows, preview pipelines, archive extraction, or storage sharing boundaries.
- Entry router for path traversal LFI vs upload insecure files skills.
- Identifies path parameter, download endpoint, or upload workflow entry points.
- Maps accept, store, process, and serve stage issue localization.
- Links to injection-checking and business-logic-vuln related categories.
- No separate payload file; routes into main topic exploitation skills.
File Access Vuln by the numbers
- 2,307 all-time installs (skills.sh)
- +123 installs in the week ending Aug 5, 2026 (Skillselion tracking)
- Ranked #227 of 2,203 Security skills by installs in the Skillselion catalog
- Security screen: LOW risk (skills.sh audit)
- Data as of Aug 5, 2026 (Skillselion catalog sync)
file-access-vuln capabilities & compatibility
- Capabilities
- entry point classification · traversal vs upload skill routing · stage based issue localization · related category cross links · upload and path chain sample pointers
- Use cases
- security audit · testing · debugging
What file-access-vuln says it does
Entry P1 category router for file access and upload workflows.
First identify whether the entry point is a path parameter, download endpoint, or upload workflow
npx skills add https://github.com/yaklang/hack-skills --skill file-access-vulnAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 2.3k |
|---|---|
| repo stars | ★ 1.5k |
| Security audit | 3 / 3 scanners passed |
| Last updated | June 16, 2026 |
| Repository | yaklang/hack-skills ↗ |
Is this file access issue path traversal LFI or an upload validation and processing chain problem?
Route file access testing between path traversal LFI and upload insecure files skills based on download, upload, preview, and storage entry points.
Who is it for?
Security engineers and developers testing file download, upload, preview, and storage endpoints.
Skip if: Skip when you already know the exact exploitation class and do not need routing.
When should I use this skill?
Use when testing download endpoints, file paths, upload flows, preview pipelines, or archive extraction boundaries.
What you get
Correct skill routing to path-traversal-lfi or upload-insecure-files with staged workflow guidance.
- routed vulnerability playbook
- LFI vs upload test classification
Files
File Access Router
This is the routing entry point for filesystem paths, download endpoints, upload pipelines, and file preview handling.
When to Use
- Parameters, filenames, download endpoints, or import flows influence file paths
- The target supports upload, preview, transcoding, extraction, sharing, download, or proxied file access
- You need to decide whether this is path traversal/LFI or an upload-validation/processing-chain issue
Skill Map
- Path Traversal LFI: path traversal, file read, wrapper abuse, include chains
- Upload Insecure Files: upload validation, storage paths, processing chains, overwrite risk, preview/share boundaries
Recommended Flow
1. First identify whether the entry point is a path parameter, download endpoint, or upload workflow 2. Then locate whether the issue appears in accept, store, process, or serve stages 3. Small path-chain and upload-bypass samples are merged into the main topic skills; no separate payload entry is needed
Related Categories
- injection-checking
- business-logic-vuln
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85How it compares
Pick file-access-vuln as the entry router for filesystem attack surfaces rather than GraphQL or auth-specific hack-skills.
FAQ
Who is file-access-vuln for?
Security engineers and developers testing file download, upload, preview, and storage endpoints.
When should I use file-access-vuln?
When testing download endpoints, file paths, upload flows, preview pipelines, or archive extraction boundaries.
Is file-access-vuln safe to install?
Review the Security Audits panel on this page before installing in production.