no-file-upload-without-validation
Do not accept MultipartFile/Part without size, type, or name checks.
Skill by StopThatSlop
Install
Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.
npx agentmarket install skill/stopthatslop-no-file-upload-without-validation
Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.
Get the weekly diff
The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.
About
Use cases: writing
Reviews
Write a reviewNo reviews yet. Installed it? Reviews come from verified installers only. How reviews work
Permissions
What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.
- Tools
- No tools found
- Secrets
- None asked for
- Install scripts
- None found
Network hosts it talks to 1
codeload.github.com· found in install command
Files it touches
~/.claude/skills/no-file-upload-without-validation
What's inside
- Skill name
no-file-upload-without-validation- Description
- Do not accept MultipartFile/Part without size, type, or name checks. Use only when editing Java upload endpoints. Do not use for internally generated files or tests.
- License
- MIT
- Metadata
- pack: stopthatslop-java-spring-v1 · globs: **/*.java · engine_rule_id: java.correctness.no-file-upload-without-validation
- Instructions
- 35 lines in SKILL.md · view on GitHub
Files (1)
- SKILL.md
SKILL.md (first lines)
# Validate file uploads
Unchecked uploads become disk bombs and stored XSS.
## Do
```java
@PostMapping("/docs")
void upload(MultipartFile file) {
if (file.getSize() > MAX_BYTES) {
throw new IllegalArgumentException("too large");
}
store.save(file);
}
```
## Do not
```java
@PostMapping("/docs")
void upload(MultipartFile file) {
store.save(file);
}
```
## Enforce
CI gates this rule (`enforcement: checker`):
```bash
python3 scripts/check.py --repo-root . --pack java --rule java.correctness.no-file-upload-without-validation
```From StopThatSlop/stopthatslop, MIT.
More from StopThatSlop/stopthatslop
- 0.569score
no-after-commit-dispatch-from-after-commit-listener
StopThatSlop
Do not re-register after-commit work from an AFTER_COMMIT @TransactionalEventListener.
SkillBFreshness: B★ 4Claude Code +9 - 0.569score
no-empty-catch-in-express-handlers
StopThatSlop
Do not swallow errors in Express handlers with empty catch blocks.
SkillBFreshness: B★ 4Claude Code +9 - 0.569score
no-except-exception-pass
StopThatSlop
Do not swallow errors with `except Exception: pass`.
SkillBFreshness: B★ 4Claude Code +9 - 0.569score
no-floating-promises
StopThatSlop
Do not leave async calls unawaited.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-eager-heavy-dependency-import
StopThatSlop
Do not statically import lodash, moment, or similar heavy packages at module top level.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-httpx-asyncclient-without-timeout
StopThatSlop
Do not construct httpx.AsyncClient (or requests.Session) without an explicit timeout.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-java-raw-pii-logging
StopThatSlop
Do not log email, phone, or similar PII fields in plaintext.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-fetch-without-abort-timeout
StopThatSlop
Do not call fetch without an abort signal timeout.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-fire-and-forget-task-without-cancellation
StopThatSlop
Do not spawn asyncio background tasks with create_task and drop the reference.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-eager-to-many-fetch
StopThatSlop
Do not map OneToMany/ManyToMany as FetchType.EAGER.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-fstring-sql-interpolation
StopThatSlop
Do not build SQL by interpolating values with f-strings, .format(), or +.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-go-dynamic-sql-execution
StopThatSlop
Do not execute SQL built with fmt.Sprintf or concatenation.
SkillBFreshness: B★ 4Claude Code +9
Signals
- Stars
- 4
- Forks
- 0
- Open issues
- 0
- Last commit (this folder)
- Sep 1, 2026 (1 month ago)
- Last release
- Sep 13, 2026 (1 month ago)
From GitHub (fetched Oct 24, 2026).
Details
- License
- MIT
- Repository
- github.com/StopThatSlop/stopthatslop
- Website
- stopthatslop.com
- First seen
- Oct 24, 2026
- Last checked
- Oct 24, 2026
- Source
- GitHubgithub-graphql
More from StopThatSlop
- 0.569score
no-floating-promises
StopThatSlop
Do not leave async calls unawaited.
SkillBFreshness: B★ 4Claude Code +9 - 0.569score
no-empty-catch-in-express-handlers
StopThatSlop
Do not swallow errors in Express handlers with empty catch blocks.
SkillBFreshness: B★ 4Claude Code +9 - 0.569score
no-after-commit-dispatch-from-after-commit-listener
StopThatSlop
Do not re-register after-commit work from an AFTER_COMMIT @TransactionalEventListener.
SkillBFreshness: B★ 4Claude Code +9 - 0.569score
no-except-exception-pass
StopThatSlop
Do not swallow errors with `except Exception: pass`.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-dynamic-sql-execution
StopThatSlop
Do not execute SQL built with f-strings, format, or concatenation.
SkillBFreshness: B★ 4Claude Code +9 - 0.566score
no-eager-to-many-fetch
StopThatSlop
Do not map OneToMany/ManyToMany as FetchType.EAGER.
SkillBFreshness: B★ 4Claude Code +9
Cite this page
no-file-upload-without-validation skill. Agent Mart. https://agentmart.dev/skills/stopthatslop-no-file-upload-without-validation (last updated 2026-10-24)