Name: file-path-traversal
Rating: 52.8 (1 reviews)
Author: administrakt0r

file-path-traversal

Identify and exploit file path traversal (directory traversal) vulnerabilities that allow attackers to read arbitrary files on the server, potentially including sensitive configuration files, credentials, and source code.

Quality

59%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/AI-Agents-Safe-Coding-Skills/skills/file-path-traversal/SKILL.md

The canonical home for this skill is file-path-traversal in administrakt0r/AI-Agents-Safe-Coding-Skills

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a thorough, actionable path-traversal testing reference with concrete commands and payload lists, but it is monolithic, repeats content across sections, and lacks validation checkpoints in its batch/offensive workflow.

Suggestions

Add explicit validation checkpoints to the testing methodology (e.g. 'Verify success: response contains root: or the win.ini [fonts] header') and a fix-and-retry loop for blocked payloads.

Move the large payload and target-file catalogs (Phases 5-6, Quick Reference tables) into separate reference files and link to them from SKILL.md to enable progressive disclosure.

Trim basic concept explanations ('../ moves up one directory') and de-duplicate payloads that recur across Phase 3-4, Phase 9, and the Quick Reference.

Dimension	Reasoning	Score
Conciseness	Mostly efficient reference material (payload lists, target files, curl/ffuf commands), but it explains basic concepts Claude already knows ('../ sequence moves up one directory') and repeats payloads across Phase 3-4, Phase 9, and the Quick Reference tables.	3 / 5
Actionability	Provides many copy-paste-ready curl, ffuf, and wfuzz commands plus concrete payload and target-file lists, but the RCE escalation payloads use '[REDACTED_RCE_PAYLOAD]' placeholders that are not directly executable.	4 / 5
Workflow Clarity	A clear 10-phase structure and an 8-step testing methodology exist, but this is a batch/offensive fuzzing operation with no explicit validation checkpoints or fix-and-retry feedback loops in the core methodology, which caps workflow clarity at 3.	3 / 5
Progressive Disclosure	Well-sectioned with clear headers (Purpose, Prerequisites, Outputs, phases, Quick Reference, Troubleshooting), but it is a ~480-line monolithic file with no bundle files and no one-level-deep references; large payload/target lists that could live in separate reference files are all inlined.	3 / 5
	Total	13 / 20 Passed

Description

61%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly names a specific vulnerability niche and its impact, with good natural trigger terms, but lacks any explicit 'Use when...' guidance and the action verbs are limited to 'identify' and 'exploit'.

Suggestions

Add an explicit trigger clause, e.g. 'Use when testing web applications for path traversal / directory traversal or local file inclusion vulnerabilities.'

Broaden action coverage beyond 'identify and exploit' to mention the concrete deliverables (map traversal points, fuzz parameters, escalate to RCE).

Include synonyms like 'LFI' or '../ traversal' to improve trigger-term comprehensiveness.

Dimension	Reasoning	Score
Specificity	Names the domain and two concrete actions ('Identify and exploit' file path traversal vulnerabilities) plus the impact scope (config files, credentials, source code), but the actions themselves are only 1-2 and not comprehensive.	3 / 5
Completeness	Clearly states what the skill does, but there is no 'Use when...' clause or equivalent explicit trigger guidance, which per the judging guidelines caps completeness at 3.	3 / 5
Trigger Term Quality	Includes natural synonyms users say ('file path traversal', 'directory traversal') plus concrete nouns like 'credentials' and 'source code', but omits common variants like 'LFI' or '../', so coverage is good rather than comprehensive.	4 / 5
Distinctiveness Conflict Risk	Targets a fairly distinct niche (path/directory traversal) with clear triggers, though it could overlap slightly with broader web-vulnerability or LFI testing skills.	4 / 5
	Total	14 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: administrakt0r/AI-Agents-Safe-Coding-Skills
Path: plugins/AI-Agents-Safe-Coding-Skills/skills/file-path-traversal/SKILL.md
Commit: 57c135b

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.