The Agent Skills Directory

[SAFE]: The skill provides detailed information on file upload vulnerabilities, such as extension bypasses, magic byte spoofing, and archive extraction attacks (Zip Slip). While it includes payload examples and command-line instructions for creating test files (e.g., using cat and zip), these are industry-standard techniques for penetration testing and vulnerability research.
[SAFE]: The document includes references to well-known security research and tools, such as the evilarc script for Zip Slip testing and CVE-2023-4863 (libwebp). These references serve to educate the user on real-world exploitation scenarios.
[SAFE]: The shell commands provided (e.g., curl for testing endpoints or pip3 install evilarc) are intended for manual execution by a security professional during a controlled audit. They do not represent automated malicious behavior or persistence mechanisms.
[SAFE]: The 'Related Skills & Chains' section provides high-level architectural context for how file upload bugs can lead to RCE, XXE, or SSRF, which is consistent with the purpose of a security testing skill.

hunt-file-upload