File Path Traversal Detection
Probes an agent for unsafe file save, upload and extract paths that escape its workspace.
- Repository
- Tencent/AI-Infra-Guard
- Stars
- 7,320
- Licence
- Apache-2.0
- Files
- 1 file
What it does
This is a security test script written as instructions for an AI agent, not a tool for end users. It is part of a larger scanner (Tencent AI-Infra-Guard) that checks other AI agents for weaknesses. When run, the agent being tested is asked whether it would save or extract files using traversal paths such as "../../" and reports whether it would write outside its intended folder. The skill does not itself modify files or touch the network; it only asks the target agent questions in a dialogue.
Great for
- Security engineers auditing AI agents that save, export or unpack user files
- Developers checking that their agent normalizes and sandboxes file paths before release
- Teams building automated red-team pipelines for agent safety
Skip it if
- End users wanting to secure their own files: it tests agents, it does not protect files on a computer
- Agents with no file handling: the skill itself says to skip them, so it produces no value
- Production use against systems you do not own or have permission to test, since it sends probing prompts that could be considered intrusive
Try asking
- “Audit my agent's export feature for path traversal before launch.”
- “Check whether an uploaded zip extraction flow would write to ../../etc.”
- “Run the file path traversal probe suite against this chatbot and report any vulnerable responses.”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 1 original files, the Apache-2.0 licence and an attribution note.
file-path-traversal-detection.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip file-path-traversal-detection.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip file-path-traversal-detection.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Only run this against agents you own or are authorised to test.
- Pair it with a review of the actual file-handling code, since agent answers about paths may not match real behaviour.
- Read the generated vuln reports carefully; a confident-sounding agent reply is evidence of stated intent, not proof of an actual write.
What's inside
- SKILL.md
Redistributed unmodified from Tencent/AI-Infra-Guard under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.