sast-pathtraversal

Detect path traversal vulnerabilities in a codebase using a three-phase approach: recon (find file-loading sinks with dynamic paths), batched verify (trace user input and mitigations in parallel subagents, 3 sinks each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/pathtraversal-results.md. Use when asked to find path traversal, directory traversal, or file disclosure bugs.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with a clearly sequenced, validation-gated multi-phase workflow, but it is monolithic and somewhat verbose, explaining concepts Claude already knows and inlining reference-style material that could live in separate files.

Suggestions

Trim the 'What is Path Traversal' conceptual introduction and the IS/IS NOT lists to a terse reference, trusting Claude's existing security knowledge and keeping only the non-obvious encodings and false-positive exclusions.

Move the large per-language vulnerable/secure example blocks and the sink-function catalogs into a reference file (e.g. references/sink-catalog.md) and link to it one level deep, reducing SKILL.md to the workflow and decision criteria.

Keep the three-phase workflow, batching procedure, and classification rubric inline since they drive execution, but condense the redundant mitigation lists that appear in both the 'Patterns That Prevent' section and the Phase 2 instructions.

Dimension	Reasoning	Score
Conciseness	The body includes conceptual exposition Claude already knows, such as the 'What is Path Traversal' definition paragraph and the 'What Path Traversal IS / IS NOT' lists, which pad the token budget; it is mostly actionable but could be tightened, matching the level-2 anchor rather than the lean level-3 case.	2 / 3
Actionability	It provides concrete per-language sink catalogs, executable mitigation snippets, an explicit batching procedure, and field-by-field output templates — copy-paste ready guidance matching the level-3 anchor rather than the incomplete/pseudocode level-2 case.	3 / 3
Workflow Clarity	The three phases are explicitly sequenced with ordering constraints and a Phase-1 validation checkpoint that short-circuits to a 'No vulnerabilities found' report when zero sinks are found, matching the level-3 anchor with feedback loops rather than the checkpoint-missing level-2 case.	3 / 3
Progressive Disclosure	It is a well-organized but monolithic 533-line file with no bundle files and no external navigation references; the large sink catalogs and multi-language example blocks are inline content that could be split into reference files, matching the level-2 'content that should be separate is inline' anchor rather than the appropriately-split level-3 case.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, third-person, and clearly answers both what the skill does and when to use it, with natural trigger terms and a distinct niche. No improvements are needed for the frontmatter.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions across three named phases — 'find file-loading sinks with dynamic paths', 'trace user input and mitigations in parallel subagents, 3 sinks each', and 'consolidate batch results' — which matches the 'Lists multiple specific concrete actions' anchor rather than the partial coverage at level 2.	3 / 3
Completeness	It explicitly answers both what it does (detect path traversal via a three-phase approach) and when to use it (explicit 'Use when...' trigger), so it meets the level-3 anchor rather than the level-2 case where the trigger is only implied.	3 / 3
Trigger Term Quality	The 'Use when asked to find path traversal, directory traversal, or file disclosure bugs' clause gives good coverage of natural terms a user would say, matching the level-3 anchor rather than the narrower level-2 set.	3 / 3
Distinctiveness Conflict Risk	The niche is sharply scoped to path traversal detection with a defined pipeline and a prerequisite artifact, making it unlikely to fire for the wrong skill; this fits the level-3 'clear niche with distinct triggers' anchor.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (545 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: utkusen/sast-skills
Path: sast-files/.agents/skills/sast-pathtraversal/SKILL.md
Commit: db52227

Reviewed: about 20 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.