Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Path Traversal Finder · dicklesworthstone | DecimalAI

dicklesworthstone/path-traversal-finder

SkillScore87Maintained

Manage path traversal finder operations. Auto-activating skill for Security Fundamentals. Triggers on: path traversal finder, path traversal finder Part of the Security Fundamentals skill category. Use when working with path traversal finder functionality. Trigger with phrases like "path traversal finder", "path finder", "path".

Securityby dicklesworthstone

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/dicklesworthstone-path-traversal-finder/SKILL.md

decimalai skills pull dicklesworthstone-path-traversal-finder --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/dicklesworthstone-path-traversal-finder/SKILL.md https://app.decimal.ai/s/dicklesworthstone-path-traversal-finder/SKILL.md

Raw file: /s/dicklesworthstone-path-traversal-finder/SKILL.md ↗ · machine-readable summary at /s/dicklesworthstone-path-traversal-finder.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 23d ago

Yes — +4% lift+5% tokens0% turns87% of whole cases pass with skill (20/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-03	✗→✓	▲ Improved	11%	0%
case-08	✗→✓	▲ Improved	-25%	0%
case-20	✗→✓	▲ Improved	-5%	0%
case-04	✓→✗	▼ Worse	15%	0%
case-22	✓→✗	▼ Worse	6%	0%

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

dicklesworthstone / pi_agent_rust

tests/ext_conformance/artifacts/plugins-community/skills/03-security-fundamentals/path-traversal-finder/SKILL.md

View on GitHub ↗

License MITImported 8/10/2026Version v1

Skill contents

SKILL.md

Path Traversal Finder

Overview

This skill provides automated assistance for path traversal finder tasks within the Security Fundamentals domain.

When to Use

This skill activates automatically when you:

Mention "path traversal finder" in your request
Ask about path traversal finder patterns or best practices
Need help with essential security skills covering authentication, input validation, secure coding practices, and basic vulnerability detection.

Instructions

Provides step-by-step guidance for path traversal finder
Follows industry best practices and patterns
Generates production-ready code and configurations
Validates outputs against common standards

Examples

Example: Basic Usage Request: "Help me with path traversal finder" Result: Provides step-by-step guidance and generates appropriate configurations

Prerequisites

Relevant development environment configured
Access to necessary tools and services
Basic understanding of security fundamentals concepts

Output

Generated configurations and code
Best practice recommendations
Validation results

Error Handling

| Error | Cause | Solution | |-------|-------|----------| | Configuration invalid | Missing required fields | Check documentation for required parameters | | Tool not found | Dependency not installed | Install required tools per prerequisites | | Permission denied | Insufficient access | Verify credentials and permissions |

Resources

Official documentation for related tools
Best practices guides
Community examples and tutorials

Related Skills

Part of the Security Fundamentals skill category. Tags: security, authentication, validation, owasp, secure-coding

Illustrative Want to see what dicklesworthstone/path-traversal-finder would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/29/2026, 12:00 UTC · 23 cases

Lift

+4%

87% vs 83%

Agent turns

1.0 vs 1.0

Tokens

+5%

2,269.04 vs 2,165.22

fail → pass · 3pass → pass · 17fail → fail · 1pass → fail · 2

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-15 If an application suffers from an unmitigated path traversal vulnerability, how does operating system level isolation (such as `chroot` or container mount namespaces) limit the impact on system files like `/etc/shadow`?	pass→pass	16,335	13,961	-15%	1	1	0%	2,356	2,382	+1%	0	0	—
case-01 I'm writing a Node.js file server that accepts a filename parameter `file` from query parameters. To prevent directory traversal, I strip `../` from the user input using `filename.replace(/\.\.\//g, '')` before passing it to `fs.readFile`. Is this input sanitization sufficient, or can an attacker bypass it? Show an example payload if bypassable and explain how to fix it.	pass→pass	12,893	12,824	-1%	1	1	0%	2,404	2,185	-9%	0	0	—
case-02 Our web application validates user-requested file paths against a blocklist for `../`. However, attackers are still accessing sensitive files via HTTP GET requests. How are attackers bypassing this blocklist filter without using literal `../` characters?	pass→pass	15,483	15,094	-3%	1	1	0%	2,376	2,779	+17%	0	0	—
case-03 In Python Flask, I am building a static asset server using `os.path.join('/var/www/uploads', user_filename)`. Since `os.path.join` safely constructs file paths, does this prevent arbitrary file read vulnerabilities when `user_filename` starts with a slash like `/etc/passwd`?	fail→pass	11,752	11,664	-1%	1	1	0%	1,944	2,160	+11%	0	0	—
case-04 In a Java Spring Boot controller, I accept `String filename` from the request and fetch files from `/var/app/data`. I am planning to validate the file path by checking `filename.contains("..")`. Is this check completely reliable across all OS environments and double-encoded inputs, and what is the standard Java NIO path validation pattern?	pass→fail	15,918	17,757	+12%	1	1	0%	2,789	3,198	+15%	0	0	—
case-05 Here is an Nginx configuration snippet for serving static assets: `location /files { alias /var/www/assets/; }`. Developers report that external users can view files outside `/var/www/assets/`. What is causing this directory traversal issue and how should the Nginx directive be corrected?	pass→pass	12,056	6,188	-49%	1	1	0%	1,935	1,342	-31%	0	0	—
case-06 In an older PHP file viewing script, user input is appended to a base path with a fixed extension: `$path = "/var/www/docs/" . $_GET['page'] . ".pdf";`. An attacker provides `../../../../etc/passwd%00`. How does the null byte affect the path resolution?	fail→fail	9,011	7,160	-21%	1	1	0%	1,576	1,579	+0%	0	0	—
case-07 I am implementing a file downloader in Go using `filepath.Join(safeDir, reqPath)`. To ensure the file is within `safeDir`, I call `filepath.Clean(reqPath)`. Is `filepath.Clean` on the user input alone sufficient to block path traversal vulnerabilities?	pass→pass	14,129	16,905	+20%	1	1	0%	2,578	2,859	+11%	0	0	—
case-08 A web application firewall (WAF) decodes incoming HTTP query string parameters once and blocks requests containing `../` or `%2e%2e%2f`. An attacker still accesses `/etc/shadow` by submitting `%252e%252e%252f`. Why does the WAF fail to detect this attack?	fail→pass	20,758	12,099	-42%	1	1	0%	3,301	2,472	-25%	0	0	—
case-09 We need to serve user uploaded profile images in Express.js. A junior developer implemented a route handler: `app.get('/avatar', (req, res) => res.sendFile('/var/app/avatars/' + req.query.name))`. What is the security vulnerability here and what standard Express/Node function or option should be used instead?	pass→pass	13,037	10,545	-19%	1	1	0%	1,344	2,209	+64%	0	0	—
case-10 In C# .NET Core, I am retrieving user files with `string fullPath = Path.Combine(baseDir, userInput)`. Does `Path.Combine` prevent directory traversal attacks if `userInput` contains `..` or an absolute path?	pass→pass	14,385	15,293	+6%	1	1	0%	2,286	2,840	+24%	0	0	—
case-11 When extracting zip archives using Java or Python, target file paths are often created by joining the destination directory with entry names from the archive (`entry.getName()`). What path traversal risk does this create and how is it mitigated?	pass→pass	18,695	14,288	-24%	1	1	0%	2,738	2,229	-19%	0	0	—
case-12 When accepting file name parameters from untrusted input, should security controls rely on stripping dangerous sequences (denylist) or enforcing an allowlist regex? Provide a secure regex for strictly alphanumeric file names with allowed extensions.	pass→pass	13,553	10,968	-19%	1	1	0%	2,429	2,432	+0%	0	0	—
case-13 A Linux-based developer tested their file path validator against `../` attacks on Linux. When deployed to Windows Server, attackers accessed system files using `..\` and `\\server\share`. Why did the validation fail on Windows?	pass→pass	13,125	13,762	+5%	1	1	0%	2,092	2,295	+10%	0	0	—
case-14 We want to detect path traversal vulnerabilities in our CI/CD pipeline using static application security testing (SAST). What source-to-sink pattern characterizes a path traversal vulnerability in static analysis rule definitions?	pass→pass	16,153	13,524	-16%	1	1	0%	2,614	2,391	-9%	0	0	—
case-16 In a GraphQL API, a field resolver takes an argument `docName: String!` and reads files from disk. Are GraphQL APIs inherently immune to directory traversal attacks because arguments are strongly typed as `String`?	pass→pass	11,322	12,676	+12%	1	1	0%	1,739	2,792	+61%	0	0	—
case-17 A developer is querying AWS S3 using the AWS SDK `s3Client.getObject({ Bucket: 'my-bucket', Key: userInput })`. Does an object key containing `../../` allow an attacker to read files from other S3 buckets or local disk?	pass→pass	14,156	12,900	-9%	1	1	0%	2,286	2,376	+4%	0	0	—
case-18 In ASP.NET Core web applications, what abstraction provides built-in path traversal protection when serving physical files from a specific directory on disk?	pass→pass	9,407	9,827	+4%	1	1	0%	1,308	1,836	+40%	0	0	—
case-19 In Ruby on Rails, a controller action contains `send_file File.join(Rails.root, 'private', params[:filename])`. Provide a code snippet demonstrating how to rewrite this controller action securely using `File.realpath`.	pass→pass	11,192	7,345	-34%	1	1	0%	1,782	1,755	-2%	0	0	—
case-20 When conducting DAST (Dynamic Application Security Testing) against a web application endpoint that returns documents, what response status codes or content signatures indicate a successful path traversal exploit when injecting `/etc/passwd`?	fail→pass	14,835	23,074	+56%	1	1	0%	2,669	2,538	-5%	0	0	—
case-21 In Python using `sqlite3`, I have a user search function executing `cursor.execute("SELECT * FROM users WHERE username = '" + username + "'")`. Rewrite this function to protect against SQL injection vulnerabilities.	pass→pass	7,123	8,387	+18%	1	1	0%	1,341	1,631	+22%	0	0	—
case-22 We are rendering user-supplied comment text in an HTML webpage. What function or strategy should be used to prevent reflected and stored Cross-Site Scripting (XSS) in contextual HTML body output?	pass→fail	13,338	12,444	-7%	1	1	0%	2,134	2,262	+6%	0	0	—
case-23 To protect our web application's session cookies against Cross-Site Request Forgery (CSRF) attacks, what `Set-Cookie` header attribute should be configured and what are its values?	pass→pass	11,485	7,377	-36%	1	1	0%	1,779	1,646	-7%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +4 percentage points is the difference between those two pass rates over the 23 comparable cases. 2 cases got worse with the skill loaded, and they are included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 82.6%
Pass rate with the skill: 87%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 2
Skill version measured: v1
Run completed: 8/29/2026, 12:00 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-03

Prompt

In Python Flask, I am building a static asset server using `os.path.join('/var/www/uploads', user_filename)`. Since `os.path.join` safely constructs file paths, does this prevent arbitrary file read vulnerabilities when `user_filename` starts with a slash like `/etc/passwd`?

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run87

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+7% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 23 days ago

Other measured skills in the registry, with their headline benchmark lift.