How do I install the File Upload skill?

Run npx skillmds@latest add yafet-dev/file-upload in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is File Upload safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with File Upload?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is File Upload free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published File Upload?

yafet-dev (@yafet-dev) published this skill. Their other Agent Skills are listed on their SkillMD profile.

File Upload by yafet-dev — Agent Skill

Name: File Upload
Author: yafet-dev

File Upload

Advanced file upload vulnerability testing methodology for bug bounty and application security work. Use when testing or reviewing unrestricted uploads, webshell upload, upload-to-RCE, stored XSS through files, SVG/image/PDF upload abuse, MIME/type validation bypass, extension bypass, archive extraction, upload SSRF, metadata abuse, path traversal in filenames, file overwrite, public storage exposure, and workflows where uploaded content is stored, processed, rendered, converted, or executed.

yafet-dev Updated Sep 21, 2026

File contents

File Upload Testing

Core Posture

Treat uploads as a pipeline: accept, validate, store, process, render, serve, and delete. Test every step, not only extension filtering.

Priority Patterns

Webshell/RCE through executable upload, admin upload, plugin upload, or server-side processing.
Stored XSS through SVG, HTML, image metadata, filename, content type, or preview pages.
SSRF/file-read through upload processors, image fetchers, PDF/SVG rendering, and importers.
Path traversal, overwrite, zip slip, symlink extraction, and archive expansion.
Public storage leaks and weak access control on uploaded files.

Assessment Loop

Inventory allowed file types, storage paths, processing jobs, public URLs, previews, exports, and deletion behavior.
Test validation: extension, MIME, magic bytes, filename, content, size, dimensions, archive structure, and metadata.
Test serving context: content type, content disposition, domain, CSP, cache, and cookies.
Test processors: thumbnails, converters, virus scanners, OCR, PDF/SVG/image renderers, and background jobs.
Confirm impact as execution, stored script, unauthorized file access, overwrite, SSRF, or sensitive data exposure.

High-Value Cues

Cue	Ask
Executable path	Can upload land where code executes?
Preview/render	Can content execute or fetch internal resources?
Filename	Can name affect paths, HTML, headers, or logs?
Archive	Can extraction escape directories or overwrite files?
Storage URL	Are private files public or guessable?

Variant Playbook

Try double extensions, case changes, null-like suffixes, MIME mismatch, polyglots, and magic byte tricks.
Test SVG/HTML/PDF/Office/image metadata and filename XSS.
Test archive paths, symlinks, nested archives, large files, and decompression bombs carefully.
Compare direct file URL, CDN URL, preview URL, download URL, and authenticated API access.
Test delete/replace/race behavior and stale public URLs.

Confirmation Discipline

Strong evidence shows execution, stored XSS, unauthorized file access, path overwrite, SSRF, or meaningful processing abuse. Rule out upload of inert files that are never served or processed dangerously.

References

Read references/advanced-methodology.md only when the task needs deeper validation bypasses, renderer/processor review, storage access checks, archive review, confirmation, or remediation guidance.

---name: file-uploaddescription: Advanced file upload vulnerability testing methodology for bug bounty and application security work. Use when testing or reviewing unrestricted uploads, webshell upload, upload-to-RCE, stored XSS through files, SVG/image/PDF upload abuse, MIME/type validation bypass, extension bypass, archive extraction, upload SSRF, metadata abuse, path traversal in filenames, file overwrite, public storage exposure, and workflows where uploaded content is stored, processed, rendered, converted, or executed.---# File Upload Testing## Core PostureTreat uploads as a pipeline: accept, validate, store, process, render, serve, and delete. Test every step, not only extension filtering.## Priority Patterns- Webshell/RCE through executable upload, admin upload, plugin upload, or server-side processing.- Stored XSS through SVG, HTML, image metadata, filename, content type, or preview pages.- SSRF/file-read through upload processors, image fetchers, PDF/SVG rendering, and importers.- Path traversal, overwrite, zip slip, symlink extraction, and archive expansion.- Public storage leaks and weak access control on uploaded files.## Assessment Loop1. Inventory allowed file types, storage paths, processing jobs, public URLs, previews, exports, and deletion behavior.2. Test validation: extension, MIME, magic bytes, filename, content, size, dimensions, archive structure, and metadata.3. Test serving context: content type, content disposition, domain, CSP, cache, and cookies.4. Test processors: thumbnails, converters, virus scanners, OCR, PDF/SVG/image renderers, and background jobs.5. Confirm impact as execution, stored script, unauthorized file access, overwrite, SSRF, or sensitive data exposure.## High-Value Cues| Cue | Ask || --- | --- || Executable path | Can upload land where code executes? || Preview/render | Can content execute or fetch internal resources? || Filename | Can name affect paths, HTML, headers, or logs? || Archive | Can extraction escape directories or overwrite files? || Storage URL | Are private files public or guessable? |## Variant Playbook- Try double extensions, case changes, null-like suffixes, MIME mismatch, polyglots, and magic byte tricks.- Test SVG/HTML/PDF/Office/image metadata and filename XSS.- Test archive paths, symlinks, nested archives, large files, and decompression bombs carefully.- Compare direct file URL, CDN URL, preview URL, download URL, and authenticated API access.- Test delete/replace/race behavior and stale public URLs.## Confirmation DisciplineStrong evidence shows execution, stored XSS, unauthorized file access, path overwrite, SSRF, or meaningful processing abuse. Rule out upload of inert files that are never served or processed dangerously.## ReferencesRead `references/advanced-methodology.md` only when the task needs deeper validation bypasses, renderer/processor review, storage access checks, archive review, confirmation, or remediation guidance.

Frequently asked questions