# path-traversal

> Claude/Codex skill by [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars · Updated 2026-07-31

Detects file operations with user-controlled paths vulnerable to ../ traversal, absolute paths, or symlink escapes. Use when writing code that opens, reads, writes, or deletes files using paths constructed from user input. Also invoke when serving static files, handling file downloads by name, or resolving paths from URL parameters or request bodies.

Tags: llms, security, skills

## Install

```sh
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/path-traversal ~/.claude/skills/path-traversal
```

## From README

Path Traversal Security Check (A01:2025) What this checks Protects against directory traversal attacks where an attacker uses ../ sequences, absolute paths, or symlinks to access files outside the intended directory. Exploitation leads to reading sensitive files (/etc/passwd, .env, private keys), overwriting configuration, or achieving remote code execution via file write. Vulnerable patterns A caller-supplied filename interpolated or concatenated into a path before opening, with no canonicalization. Path-join helper used as the only defense — these collapse some .. segments but do not verify the final path stays under the intended root, and many treat an absolute caller-supplied path as overriding the base. Existence or stat check on the user path that does not follow symlinks, but the subsequent read/write does — symlink escape. Canonicalization performed once at handler entry, but a later file operation uses the un-canonicalized value.

## Links

- HTML page: https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/path-traversal/
- GitHub: https://github.com/thejefflarson/soundcheck
- Author: [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md)

## More from this repo

- [authentication-failures](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/authentication-failures/index.md) — Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [broken-access-control](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/broken-access-control/index.md) — Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [concurrency-correctness](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/concurrency-correctness/index.md) — Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars