File Upload Security Audit (offensive-file-upload)

Authorization & Scope Notice: This skill is part of the REA_Skill + claude-red Unified Security & Reverse Engineering Suite. It is designed strictly for authorized security assessments, defensive architecture reviews, vulnerability triage, bug bounty verification, and remediation engineering on software, infrastructure, and assets you own or have explicit permission to test.

Overview

File upload security auditing covering extension allowlisting, MIME and magic-byte verification, path traversal in filenames, archive extraction (Zip Slip), image processing parser safety, polyglot file handling, and isolated object storage serving with nosniff headers. Use when auditing upload handlers and media pipelines.

Operational Workflow