lfi

Path traversal and Local File Inclusion (LFI) — arbitrary file reading via directory traversal, PHP filter/input/data wrappers for RCE, log poisoning, static resource disclosure, and information leakage. Use for any challenge involving file path manipulation, ../ traversal, local file read, PHP wrappers, or sensitive file disclosure.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable commands and an exceptionally clear, checkpointed decision tree including mandatory verification loops. Its weaknesses are token efficiency (repeated rationale and prose that assume less than Claude knows) and progressive disclosure (everything inlined in one long file with no reference split).

Suggestions

Tighten or move to a reference the nginx 'Why it works' / alias-vs-root disambiguation prose — Claude can derive these mechanics from the fingerprint and exploit pattern, so a one-line 'only alias (not root) is affected' suffices.

Split the long 'Protected LFI Escalation Rule' (Steps W1-W6) and the full bypass/probe catalogue into a references/ file, leaving SKILL.md as a decision-tree overview with one-level-deep pointers, which would raise progressive_disclosure without losing actionability.

De-duplicate the pivot discipline / anti-pattern guidance, which currently appears after both the Response Body Verification section and the Protected LFI section making near-identical points about not iterating dead vectors.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and assumes Claude's competence, but several prose blocks (e.g. the 'Why it works' nginx-alias explanation, the alias-vs-root disambiguation, and repeated pivot/anti-pattern rationales) re-explain mechanics at length where a tighter note would do, and decision-tree plus prose rules restate the same branches multiple times.	3 / 5
Actionability	Copy-paste-ready curl commands across every technique class, with parameterized placeholders, concrete flag/config guesses, and base64 decode pipes; examples cover the common cases and are fully executable rather than pseudocode.	5 / 5
Workflow Clarity	A mandated decision tree and Step 0 probe sequence (A/A2/B/C in exact order) with explicit verification checkpoints (Response Body Verification, STEP W1 wrapper gate, cmp against blocked baseline) provide feedback loops and error-recovery pivots for batch/destructive probing operations.	5 / 5
Progressive Disclosure	No bundle files exist (references/, scripts/, assets/ absent) and the body is a single ~325-line monolith covering detection, server-level traversal, verification, wrappers, log poisoning, and a protected-LFI escalation chain; sections are headed but content that could live in a separate reference (e.g. the full protected-LFI escalation rule) is inlined, so it sits at 'some structure but could be better organized' rather than well-split.	3 / 5
	Total	16 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is a model example: it specifies concrete capabilities, lists a rich set of natural trigger terms including synonyms and shorthand, explicitly pairs a 'what' with a 'when' clause, and carves out a distinctive niche with low conflict risk.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions (arbitrary file reading via directory traversal, PHP filter/input/data wrappers for RCE, log poisoning, static resource disclosure, information leakage) covering the skill comprehensively, matching the 'multiple specific concrete actions; comprehensive coverage' anchor.	5 / 5
Completeness	Explicitly answers both what ('Path traversal and LFI — arbitrary file reading via ... wrappers for RCE, log poisoning ...') and when ('Use for any challenge involving file path manipulation, ../ traversal, local file read, PHP wrappers, or sensitive file disclosure'), matching the top anchor with concrete trigger phrases.	5 / 5
Trigger Term Quality	Comprehensive natural-term coverage including synonyms and shorthand (path traversal, LFI, local file inclusion, ../, dot dot slash, PHP wrappers, file read) plus the metadata when_to_use adds even more variants, matching the 'comprehensive coverage including synonyms' anchor.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (path traversal / LFI exploitation) with distinct, specific triggers (../, PHP wrappers, log poisoning) that are unlikely to fire for unrelated skills, matching the 'clear niche with distinct triggers; minimal conflict risk' anchor.	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/web/lfi/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.