File Upload Vulnerability Checklist
Guides an agent through testing web file upload features for security bypass weaknesses
- Repository
- SnailSploit/Claude-Red
- Stars
- 10,230
- Licence
- MIT
- Files
- 1 file
What it does
This skill gives the AI agent a structured checklist for finding weaknesses in websites' file upload features, such as bypassing type checks, disguising malicious files, path traversal in filenames, and malicious SVG or HTML uploads. Once installed, when a conversation touches on upload testing, the agent works through the checklist step by step, considers which techniques fit the target, tracks progress, and suggests next steps. It is written for authorized penetration testing and bug bounty work.
Great for
- Security testers doing authorized web application penetration tests
- Bug bounty hunters reviewing upload endpoints in scope
- Students learning how file upload vulnerabilities work
Skip it if
- Attacking websites without written permission, since the checklist is offensive and testing unauthorized systems is illegal
- Developers who only need to build secure upload handling; the skill focuses on attacking, not defensive coding
- Non-technical users looking for a simple file-upload feature, as it contains no implementation help
Try asking
- “Walk me through a file upload checklist for this authorized test of our profile picture endpoint”
- “Which double-extension and case-sensitivity bypasses should I try on this upload form?”
- “How could an SVG upload lead to stored XSS, and what should I test?”
- “Suggest next steps after my content-type bypass attempts failed on the document upload”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 1 original files, the MIT licence and an attribution note.
offensive-file-upload.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip offensive-file-upload.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip offensive-file-upload.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Only use this on systems you own or have written authorization to test, and state the scope in your request.
- Provide details of the target's upload behaviour (client-side checks, error messages, accepted types) so the agent can prioritise techniques.
- Pair it with a proxy such as Burp Suite or ZAP as the skill itself only supplies the methodology, not tooling.
What's inside
- SKILL.md
Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.