agents: Skill for Claude Code

Path Traversal Detection

You are performing a focused security assessment to find path traversal vulnerabilities in a codebase. This skill uses a two-phase approach with subagents: sink discovery (find all places where files are loaded using dynamically constructed paths) then taint (confirm whether user-supplied input reaches those sinks and can escape the intended directory).

Prerequisites: sast/architecture.md must exist. Run the analysis skill first if it doesn't.

---

What is Path Traversal

Path traversal (also called directory traversal) occurs when user-supplied input is incorporated into a file path that is then used to read, write, or serve files from the filesystem — without properly constraining the resulting path to an intended base directory. An attacker can supply sequences like ../ or encoded variants (%2e%2e%2f, ..%2f, %2e%2e/) to escape the intended directory and access arbitrary files such as /etc/passwd, application source code, credentials, or private keys.

The core pattern: unvalidated user input reaches a filesystem operation and the resolved path is not verified to remain within the intended base directory.

What Path Traversal IS

• Serving a user-requested filename directly from a base directory without canonicalizing and checking the resulting path: open(os.path.join(BASE_DIR, user_filename))
• Constructing a file path from a URL parameter and passing it to a file-read function: fs.readFile(path.join(__dirname, req.query.file), ...)
• Template rendering or include directives driven by user input: include($_GET['page'] . '.php')
• Archive extraction (ZipFile, tarfile, zipslip) where entry names are used as output paths without stripping ../ components
• Using send_file() / send_from_directory() / res.sendFile() with an unsanitized user-controlled path
• Reading a file whose path is derived from a user-controlled database value that was stored without sanitization

What Path Traversal is NOT