Detect insecure file upload vulnerabilities in server-side upload handlers.
npx skills add https://github.com/fatihkan/badi --skill sc-file-upload-fatihkan
Please help me install this Agent Skill. Skill: sc-file-upload Source: https://github.com/fatihkan/badi/tree/main/.claude/skills/security-check/sc-file-upload Command: npx skills add https://github.com/fatihkan/badi --skill sc-file-upload-fatihkan
Insecure file upload detection — unrestricted types, MIME mismatch, polyglot files, and webshell upload
Run the scanner against your upload endpoints to identify misconfigurations and risky patterns.
High-intent search queries and answers about installing and using this skill.
Prevent insecure file upload vulnerabilities by enforcing server-side validation, restricting MIME types, rejecting double extensions, and storing uploaded files outside the web root with randomized filenames.
Common file upload vulnerabilities include unrestricted file types, MIME-type mismatches, double extensions, polyglot files, and uploading webshells to web-accessible directories, all of which can enable remote code execution.
Detect MIME mismatch and double extension attacks by scanning server-side upload handlers across languages and frameworks, verifying that file extensions and MIME types align and rejecting suspicious patterns.
Yes, this scanner applies to server-side upload handlers across various languages and frameworks to detect misconfigurations, risky patterns, and unrestricted upload types without requiring specific dependencies.
Secure file uploads for CI pipelines by running the scanner against upload endpoints to identify misconfigurations, enforcing filename sanitization, and generating actionable findings for threat modeling.
Storing uploaded files outside the web root with randomized filenames prevents direct web access to malicious files, mitigating the risk of webshell execution and remote code execution attacks.
0x1337c0d3Identifies and inventories external data entry points, classifying them by authentication, input types, validation, risk factors, and exposure for integration with Sentinel's scanning pipeline and risk scoring system.
AI-SafeterAudit code, CI/CD pipelines, and deployments for DevSecOps security gaps.
snoodleboot-ioIdentify security threats in software systems using static code analysis and pattern matching.
ShaggyDPatch browser fingerprint vectors at document_start to prevent headless automation detection.
