Path Traversal
DevOps & Securitypath-traversalPath Traversal is an Agent Skill for devops & security published in the PurpleAILAB/Decepticon repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Hunt directory traversal and archive traversal (ZipSlip/TarSlip) from user input to filesystem operations.
QUICK START
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/PurpleAILAB/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/standard/analyst/path-traversal/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/path-traversal, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
Path Traversal Playbook
Find sinks
open(user_path),send_file(user_path), file download endpoints, archive extraction APIs.
Probe payload classes
- Relative traversal:
../../../../etc/passwd - Encoded traversal:
%2e%2e%2f - Mixed separators:
..\\..\\windows\\win.ini - Archive traversal: entries like
../../app/config.py
Verify controls
- Canonicalization done before allowlist check.
- Path confinement to intended root.
Validation
Confirm unauthorized file read/write outside allowed directory with positive and negative controls.