Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →jeremylongshore/detecting-directory-listing
Probe a target for directories that return auto-generated index listings instead of denying or serving a specific file — exposes the full file tree under any reachable directory, including files the application never linked to.
Passed 17 of 20 test cases with the skill, and 9 of 20 without it.
and 7 more in the full report
9 fixed10 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 9 test cases the skill fixed. Same model, same prompt, with and without the skill.
We need to probe a custom list of candidate paths stored in /tmp/paths.txt against https://app.internal.org using our directory listing scanner. What flag passes this file?
| Checked | Without skill | With skill |
|---|---|---|
| Uses the --paths-file option to supply the path list | Missed | Passed |
The instructions your model reads when the skill loads.
Web servers can be configured to auto-generate an HTML index page
when a request hits a directory without a matching default file
(no index.html / index.php / etc.). The auto-generated page
lists every file in the directory. This is by design for static-
file servers and FTP-style file-sharing setups; it's a misconfiguration
on application servers where the file tree was never meant to be
public.
The risk compounds in two ways:
/.git/ request that
returns an autoindex listing reveals every object file under
.git/objects/ and confirms the entire repo is reachable for
GitDumper-style reconstruction.This skill probes commonly-vulnerable directory paths and grades each based on the framework-specific autoindex fingerprint.
| Finding | Severity | Threshold | Affected control |
|---|---|---|---|
| Application-root directory listing | HIGH | / returns autoindex page | OWASP A05:2021 |
| Backup / upload / log directory listing | HIGH | /backup/, /uploads/, /logs/, /dump/ autoindex | CWE-548 |
Asset directory listing (/assets/, /static/) | MEDIUM | autoindex on asset dirs (enables file enumeration) | CWE-548 |
| Config directory listing | CRITICAL | /config/, /conf/, /.config/ autoindex | NIST 800-53 SC-28 |
| VCS subdir listing (chains with skill #6) | CRITICAL | /.git/, /.svn/, /.hg/ autoindex | NIST 800-53 SC-28 |
| Generic root reachable via autoindex | MEDIUM | / or arbitrary path autoindex on app server | OWASP A05:2021 |
requeststest cases passed, vs 9 / 20 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.