file-path-traversal

This skill should be used when the user asks to "test for directory traversal", "exploit path traversal vulnerabilities", "read arbitrary files through web applications", "find LFI vulnerabilities", or "access files outside web root". It provides comprehensive file path traversal attack and testing methodologies.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable and well-organized but suffers from redundancy across phases and an over-long monolithic structure that would benefit from splitting reference material into separate files. Adding explicit success-validation checkpoints to the testing methodology would lift workflow clarity.

Suggestions

De-duplicate payloads: keep canonical payloads in Phase 3/4 and have the Quick Reference tables and Phase 9 methodology link to them instead of restating them.

Add explicit per-step validation checkpoints in the Phase 9 methodology (e.g., after each payload step, confirm a success indicator like `root:` in /etc/passwd before moving on).

Split large reference blocks (target-file lists, encoding variants, prevention code) into files under references/ and link to them from SKILL.md to reduce inline bulk and improve progressive disclosure.

Dimension	Reasoning	Score
Conciseness	It avoids concept-fluff Claude already knows (no "what is a filesystem" preamble) and is mostly dense payloads, but it repeats material — the same payloads appear in Phase 3, Phase 4, and Quick Reference, and Phase 9 re-lists earlier payloads — so it lands at the 2-anchor (mostly efficient, could be tightened) rather than the lean 3-anchor or padded 1-anchor.	2 / 3
Actionability	Executable curl/ffuf/wfuzz commands, concrete PHP/Python remediation code, specific payloads and target file paths make it copy-paste ready, matching the 3-anchor rather than the incomplete 2-anchor.	3 / 3
Workflow Clarity	A clear phased sequence plus a numbered Phase 9 methodology is present, but there are no explicit per-step validation/success-confirmation checkpoints (e.g., "confirm `root:` appears before escalating"); the only success cue ("filter responses by size/content") is implicit, so it caps at the 2-anchor rather than reaching the checkpoint-driven 3-anchor.	2 / 3
Progressive Disclosure	The ~480-line body is well-sectioned (clear headings) but entirely monolithic with no bundle/reference files; large reference material (payload lists, target files, prevention code) that should be split into one-level-deep references is inline, fitting the 2-anchor rather than the split-and-signaled 3-anchor.	2 / 3
	Total	9 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it pairs explicit use-trigger phrasing with concrete, natural-sounding actions and a clearly bounded niche, satisfying all four dimensions. The only minor weakness is the generic "comprehensive methodologies" wording for the what-clause.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions a user would request — "test for directory traversal", "exploit path traversal vulnerabilities", "read arbitrary files", "find LFI vulnerabilities", "access files outside web root" — matching the 3-anchor of multiple specific concrete actions rather than the partial 2-anchor.	3 / 3
Completeness	Explicit "when" triggers ("This skill should be used when the user asks to...") plus a "what" clause ("provides comprehensive file path traversal attack and testing methodologies") satisfy the 3-anchor for both; it is not capped at 2 because explicit trigger guidance is present.	3 / 3
Trigger Term Quality	Covers natural phrasings a pentester/user would actually say ("path traversal", "LFI", "read arbitrary files", "files outside web root"); not jargon-only or generic, so it sits at the 3-anchor rather than the 2-anchor of partial coverage.	3 / 3
Distinctiveness Conflict Risk	The niche (file path traversal / LFI) is narrow with distinct triggers unlikely to fire for unrelated skills, matching the 3-anchor rather than the overlapping 2-anchor.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zebbern/claude-code-guide
Path: skills/file-path-traversal/SKILL.md
Commit: af7d491

Reviewed: about 9 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.