lfi-traversal

Focused LFI/path-traversal checklist — absolute paths, encodings, wrappers, proof.

IndexedMIT★ 1

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/venkatas-lfi-traversal

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

Focused LFI/path-traversal checklist — absolute paths, encodings, wrappers, proof.

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.

Tools: No tools found
Secrets: None asked for
Install scripts: None found

Network hosts it talks to 1

codeload.github.com · found in install command

Files it touches

~/.claude/skills/lfi-traversal

What's inside

Skill name: lfi-traversal
Description: Focused LFI/path-traversal checklist — absolute paths, encodings, wrappers, proof.
License: MIT
Instructions: 18 lines in SKILL.md · view on GitHub

Files (1)

SKILL.md

SKILL.md (first lines)

# LFI / Path Traversal

## Checklist
- [ ] Raw absolute path FIRST: `/etc/passwd`, `file:///etc/passwd` (often missed)
- [ ] Relative traversal depth 1–12
- [ ] Filter-stripping bypass: `....//....//etc/passwd`
- [ ] Encodings: `%2e%2e%2f`, double-encode, null byte on legacy, `?`/`#` suffix
- [ ] PHP wrappers: `php://filter/convert.base64-encode/resource=...`

## Common bypasses
- Leading-slash variants `//etc/passwd`, `/%2e/etc/passwd`
- Windows: `C:\windows\win.ini`, `..\..\`

## Proof standard
- Known file content signature (`root:x:0:0:` / `win.ini` keys). Generic 200 error page ≠ read.
- One blocked `../` payload ≠ negative until absolute/encoding/wrapper matrix tried.

From venkatas/vikramaditya, MIT.

Signals

Stars: 1
Forks: 1
Open issues: 0
Last commit (this folder): Sep 7, 2026 (1 month ago)

From GitHub (fetched Oct 24, 2026).

Details

License: MIT
Repository: github.com/venkatas/vikramaditya
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: GitHub github-graphql

More from venkatas

Cite this page

lfi-traversal skill. Agent Mart. https://agentmart.dev/skills/venkatas-lfi-traversal (last updated 2026-10-24)