Strix•不安全文件上传
Strix 文件上传安全测试手册,覆盖扩展名绕过、Content-Type 操控与路径穿越;触发名:strix-insecure-file-uploads
Profile →npx skills add asdfgh1445/ctf-super-hub --skill strix-insecure-file-uploads --agent codex
Same command for any agent — swap --agent for claude-code, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Insecure File Uploads Upload surfaces are high risk: server-side execution (RCE), stored XSS, malware distribution, storage takeover, and DoS. Modern stacks mix direct-to-cloud uploads, background processors, and CDNs—authorization and validation must hold across every step. ## Attack Surface - Web/mobile/API uploads, direct-to-cloud (S3/GCS/Azure) presigned flows, resumable/multipart protocols (tus, S3 MPU) - Image/document/media pipelines (ImageMagick/GraphicsMagick, Ghostscript, ExifTool, PDF engines, office converters) - Admin/bulk importers, archive uploads (zip/tar), report/template uploads, rich text with attachments - Serving paths: app directly, object storage, CDN, email attachments, previews/thumbnails ## Reconnaissance ### Surface Map - Endpoints/fields: upload, file, avatar, image, attachment, import, media, document, template - Direct-to-cloud params: key, bucket, acl, Content-Type, Content-Disposition, x-amz-meta-*, cache-control - Resumable APIs: create/init → upload/chunk → complete/finalize; check if metadata/headers can be altered late - Background processors: thumbnails, PDF→image, virus scan queues; identify timing and status transitions ### Capability Probes
- Attack Surface
- Reconnaissance
- Surface Map
- Capability Probes
- Detection Channels
- Server Execution
- Client Execution
- Header and Render
- Process Side Effects
- Core Payloads
- Web Shells and Configs
- Stored XSS
- MIME Magic Polyglots
- Archive Attacks
What does the Strix•不安全文件上传 skill do?
Strix 文件上传安全测试手册,覆盖扩展名绕过、Content-Type 操控与路径穿越;触发名:strix-insecure-file-uploads
How do I install it?
Run `npx skills add asdfgh1445/ctf-super-hub --skill strix-insecure-file-uploads --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From asdfgh1445/ctf-super-hub, a repository with 718 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.