file-upload-security
From the author
Use when a WordPress plugin or theme accepts file uploads, processes $_FILES, saves user-provided files, or generates file paths from input. Uses wp_handle_upload and wp_check_filetype_and_ext with a MIME/extension allowlist, blocks executable types, and prevents path traversal. Prevents arbitrary file upload and RCE. Apply proactively to any upload or file-writing code path.
Install
npx skills add wpultimatesecurity/WordPress-Security-Skills --skill file-upload-security -a claude-code
Installs to .claude/skills/file-upload-security/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 76
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- offensive-file-upload26zl/cybersec-toolkitFile upload vulnerability checklist: MIME type bypass, extension bypass, magic byte manipulation, path traversal in filenames, stored XSS via SVG/HTML upload, server-side processing attacks, and race conditions. Use for assessing file upload endpoints in web app pentests or bug bounty. Use only for authorized security research, training, or assessment.Security★ 82
- filesystem-securitywpultimatesecurity/WordPress-Security-SkillsUse when reading, writing, including, or deleting files from paths that include user input - include / require, readfile, unlink, file_get_contents, or the WP_Filesystem API. Validates paths with validate_file, normalizes with wp_normalize_path, confines operations to an allowed base directory, and uses wp_delete_file / WP_Filesystem. Prevents path traversal, local file inclusion, and arbitrary file deletion.Security★ 53
- wordpresssickn33/agentic-awesome-skillsWordPress development workflow covering theme development, plugin creation, WooCommerce integration, performance optimization, and security hardening. Includes WordPress 7.0 features: Real-Time Collaboration, AI Connectors, Abilities API, DataViews, and PHP-only blocks.Security★ 48.5K
- secure-plugin-developmentwpultimatesecurity/WordPress-Security-SkillsUse when starting a new WordPress plugin or theme, scaffolding a plugin file, wiring hooks, or adding any feature that handles requests, options, or output. Establishes the secure-by-default baseline — ABSPATH guard, the capability + nonce + sanitize + escape flow, prepared queries, and safe defaults — and routes to the focused security skills for each concern. Apply proactively at the start of any WordPress build.Security★ 53
- wordpress-plugin-coresecondsky/claude-skillsWordPress plugin development with hooks, security, REST API, custom post types. Use for plugin creation, $wpdb queries, Settings API, or encountering SQL injection, XSS, CSRF, nonce errors.Security★ 236
- security-headers-cspwpultimatesecurity/WordPress-Security-SkillsUse when adding HTTP response headers to a WordPress site or plugin: Content-Security-Policy (or Report-Only), X-Content-Type-Options, frame protection (X-Frame-Options or frame-ancestors), Referrer-Policy, Permissions-Policy, HSTS, Secure/HttpOnly/SameSite cookie flags, or CORS on REST responses. Covers the wp_headers filter, the send_headers, login_init and admin_init surfaces, per-request CSP nonces via script_loader_tag, and REST origin restriction through core's allowlist. Headers are the second XSS layer after output escaping, and they also stop clickjacking and MIME sniffing.Security★ 53
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in