file-access-vuln

Routes file access and upload vulnerability testing to specialized workflow skills.

Updated Jun 5, 2026
One-click install
npx skills add https://github.com/lNwNl/Praxis --skill file-access-vuln-lnwnl
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: file-access-vuln
Source: https://github.com/lNwNl/Praxis/tree/main/skills/file-access-vuln
Command: npx skills add https://github.com/lNwNl/Praxis --skill file-access-vuln-lnwnl

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? When testing web applications for file-related vulnerabilities, it is often unclear whether an issue is a path traversal/LFI problem or an upload validation and processing-chain flaw. This Skill acts as a category router that directs testing to the correct specialized workflow. ## Core Features & Use Cases - Entry Point Classification: Identifies whether the attack surface is a path parameter, download endpoint, or upload workflow. - Skill Routing: Directs testing to the Path Traversal LFI skill (path traversal, file read, wrapper abuse, include chains) or the Upload Insecure Files skill (validation, storage paths, processing chains, overwrite risk, preview/share boundaries). - Stage Localization: Helps locate whether the issue appears in the accept, store, process, or serve stage of file handling. - Use Case: During a CTF or authorized penetration test, you find a download endpoint that takes a filename parameter. Use this Skill to decide whether to pursue path traversal payloads or investigate the upload and preview pipeline instead. ## Quick Start Analyze this download endpoint and tell me whether to test it for path traversal or upload validation issues.

Frequently Asked Questions about file-access-vuln

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test a download endpoint for path traversal?▼

Identify whether the endpoint takes a filename or path parameter, then follow the Path Traversal LFI skill for traversal sequences, file read techniques, wrapper abuse, and include chains. This router helps confirm the endpoint type first.

What is the difference between path traversal and insecure file upload?▼

Path traversal and LFI exploit file path resolution to read or include unintended files. Insecure upload issues involve validation bypasses, unsafe storage paths, processing chains, overwrite risk, and preview or sharing boundaries.

When should I use the upload insecure files workflow instead of LFI testing?▼

Use the upload workflow when the target supports upload, preview, transcoding, extraction, sharing, or proxied file access, and the weakness lies in the accept, store, process, or serve stages rather than in path resolution.

Does this skill contain its own payloads for file inclusion testing?▼

No. Small path-chain and upload-bypass samples are merged into the main topic skills, so no separate payload entry exists here. This skill only routes you to the appropriate specialized workflow.

What related vulnerability categories connect to file access testing?▼

The skill references injection-checking and business-logic-vuln as related categories, since file handling flaws often intersect with injection points and logic-level authorization boundaries.