domains / families / security / sast-fileupload

sast-fileupload

authentic

Detect insecure file upload vulnerabilities in a codebase using a three-phase approach: discovery (find all upload sites), batched verify (check extension bypass and related issues in parallel subagents, 3 sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/fileupload-results.md. Use when asked to find file upload, unrestricted upload, or extension bypass bugs.

When to use

• find file upload bugs
• unrestricted upload detection
• extension bypass bugs
• insecure file upload vulnerabilities

When not to use

• Stored XSS via SVG
• SSRF via file content
• DoS via large files
• IDOR on download
• Secure uploads

Skill page

Source