Axguard Path — Development skill for Claude Code
Path traversal / LFI — open/join, send_file, PHP include with variables.
How to install Axguard Path
Installs to ~/.claude/skills/awarexone-axguard-axguard-path/SKILL.md
mkdir -p ~/.claude/skills/awarexone-axguard-axguard-path && curl -fsSL https://raw.githubusercontent.com/Awarexone/AXguard/HEAD/commands/axguard-path.md -o ~/.claude/skills/awarexone-axguard-axguard-path/SKILL.md Restart Claude Code, or start a new session, for it to be picked up.
What Axguard Path does
description: Path traversal / LFI — open/join, send_file, PHP include with variables. Usage: /axguard-path [path]
/axguard-path
**Specialist:** Path Traversal Hunter
Usage
/axguard-path
/axguard-path ./api
Focus
open/Pathjoins with variable segmentssend_file/sendFile/res.downloadwith user paths- PHP
include/requirewith$variables
Steps
- Scan → keep
path.*. - Resolve whether
..or absolute paths can escape the intended root
Alternatives in Development
- Param Discover — Discover hidden HTTP parameters on a URL or list of URLs using Arjun (or x8 fallback) 4.5k ★
- n8n Expression Syntax — n8n expression syntax with {{}} and $json/$node variables 3.6k ★
- Dotenv Vault — Sync environment variables across machines for consistent Claude Code behavior 1.2k ★
Full documentation available on GitHub
View Source RepositoryRelated Skills
0x002132 Skills Bugbounty Hunt File Upload
Hunt file upload bugs — RCE via webshell, XSS via SVG/HTML, SSRF via XXE in DOCX, path traversal via filename.
Axguard Auth
AuthZ / IDOR / JWT / CSRF footgun hunt. Usage: /axguard-auth [path]
Axguard Cloud
Cloud and CORS misconfig — metadata URLs, wildcard origins. Usage: /axguard-cloud [path]
Axguard Ssrf
SSRF and unsafe egress — user-influenced fetch/requests, metadata IPs. Usage: /axguard-ssrf [path]
Env
Manage Vercel environment variables. Commands include list, pull, add, remove, and diff. Use to sync environme
Input Validation Injection
Stop SQLi, XSS, command/template injection, SSRF, path traversal, XXE, deserialization.
Related Agents
Cacador Injecao
Caçador do domínio de injeção na auditoria NIST — SQL, NoSQL, comando de SO, path traversal, SSTI, XSS refleti
Seam Auditor
Composition adversary - finds two correct units whose join lies. Orthogonal to the house happy/sad-path signat
File Upload
File Upload vulnerability specialist (H1 #39). Use for testing upload restrictions, content-type bypass, exten