file-upload-security
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill documents best practices for preventing arbitrary file upload and remote code execution (RCE) vulnerabilities in WordPress environments.
- [SAFE]: The provided PHP implementation correctly utilizes CSRF protection with
check_admin_referer()and enforces proper authorization checks viacurrent_user_can(). - [SAFE]: Secure path handling is demonstrated using
realpath()and prefix matching to prevent path traversal attacks, andsanitize_file_name()is used to mitigate filename-based injection. - [SAFE]: The skill emphasizes the use of MIME type allowlists and server-side verification of file extensions against actual content using
wp_check_filetype_and_ext(). - [SAFE]: No obfuscation, data exfiltration patterns, or unauthorized remote code execution mechanisms were identified in the instructions or reference files.
Audit Metadata