path-traversal
Test file and archive path resolution when user-controlled names or paths may escape an intended storage root or select unintended local resources.
Skill by hellodqy
Install
Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.
npx agentmarket install skill/hellodqy-path-traversal
Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.
Get the weekly diff
The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.
About
Use cases: testing
Reviews
Write a reviewNo reviews yet. Installed it? Reviews come from verified installers only. How reviews work
Permissions
What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.
- Tools
- No tools found
- Secrets
- None asked for
- Install scripts
- None found
Network hosts it talks to 1
codeload.github.com· found in install command
Files it touches
~/.claude/skills/path-traversal
What's inside
- Skill name
path-traversal- Description
- Test file and archive path resolution when user-controlled names or paths may escape an intended storage root or select unintended local resources.
- License
- unknown
- Metadata
- tags: path-traversal,lfi,file-read,archive,zip-slip
- Instructions
- 27 lines in SKILL.md · view on GitHub
Agent Skills spec issues
- name: "path-traversal" does not match folder "path_traversal"
- files: referenced but missing: references/INDEX.md
Files (1)
- SKILL.md
The license isn't open source, so the instructions aren't shown here. Read SKILL.md on GitHub
More from hellodqy/mastermind-bug-bounty
- 0.594score
mastermind-bug-bounty
hellodqy
Four-phase autonomous bug bounty orchestration.
SkillBFreshness: B★ 14Claude Code +9 - 0.590score
mail-code
hellodqy
Create and monitor a disposable test mailbox when an authorized registration, recovery, email-verification, or magic-link flow requires an isolated email…
SkillBFreshness: B★ 14Claude Code +9 - 0.585score
recon-agent
hellodqy
Asset reconnaissance agent.
SkillBFreshness: B★ 14Claude Code +9 - 0.585score
bypass-agent
hellodqy
Access-control bypass agent.
SkillBFreshness: B★ 14Claude Code +9 - 0.585score
deserialization
hellodqy
Test serialized objects, polymorphic payloads, message formats, and naming lookups when untrusted data may instantiate types or trigger dangerous behavior.
SkillBFreshness: B★ 14Claude Code +9 - 0.585score
api-fuzz-agent
hellodqy
API exploration agent.
SkillBFreshness: B★ 14Claude Code +9 - 0.584score
injection-test
hellodqy
Test parser and interpreter boundaries when user-controlled values reach database queries, templates, commands, expressions, headers, or downstream protocols.
SkillBFreshness: B★ 14Claude Code +9 - 0.582score
passive-recon
hellodqy
Collect external context without touching the target aggressively.
SkillBFreshness: B★ 14Claude Code +9 - 0.582score
crypto-attack-agent
hellodqy
Crypto and token reasoning agent.
SkillBFreshness: B★ 14Claude Code +9 - 0.581score
account-takeover
hellodqy
Analyze login, recovery, verification, MFA, session refresh, and account binding flows when a weakness may let one user assume another identity.
SkillBFreshness: B★ 14Claude Code +9 - 0.581score
http-smuggling
hellodqy
Consider request smuggling only when architecture hints make it relevant, and connect confirmation to downstream impact.
SkillBFreshness: B★ 14Claude Code +9 - 0.581score
business-logic
hellodqy
Test multi-step business workflows when server-side state, value, ownership, or transition invariants may be bypassed without a conventional injection flaw.
SkillBFreshness: B★ 14Claude Code +9
Signals
- Stars
- 14
- Forks
- 1
- Open issues
- 0
- Last commit (this folder)
- Sep 14, 2026 (1 month ago)
- Last release
- Sep 15, 2026 (1 month ago)
From GitHub (fetched Oct 24, 2026).
Details
- License
- License unknown
- First seen
- Oct 24, 2026
- Last checked
- Oct 24, 2026
- Source
- GitHubgithub-graphql
More from hellodqy
- 0.594score
mastermind-bug-bounty
hellodqy
Four-phase autonomous bug bounty orchestration.
SkillBFreshness: B★ 14Claude Code +9 - 0.590score
mail-code
hellodqy
Create and monitor a disposable test mailbox when an authorized registration, recovery, email-verification, or magic-link flow requires an isolated email…
SkillBFreshness: B★ 14Claude Code +9 - 0.585score
api-fuzz-agent
hellodqy
API exploration agent.
SkillBFreshness: B★ 14Claude Code +9 - 0.585score
bypass-agent
hellodqy
Access-control bypass agent.
SkillBFreshness: B★ 14Claude Code +9 - 0.585score
recon-agent
hellodqy
Asset reconnaissance agent.
SkillBFreshness: B★ 14Claude Code +9 - 0.585score
deserialization
hellodqy
Test serialized objects, polymorphic payloads, message formats, and naming lookups when untrusted data may instantiate types or trigger dangerous behavior.
SkillBFreshness: B★ 14Claude Code +9
Cite this page
path-traversal skill. Agent Mart. https://agentmart.dev/skills/hellodqy-path-traversal (last updated 2026-10-24)