# file-uploads

A Claude skill that guides the agent through file uploads and cloud storage: S3, Cloudflare R2, presigned URLs, multipart transfers and image optimization.

- skill · `type=skill` · Claude Code · 185 installs
- Author: davila7
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/file-uploads
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/file-uploads

## What it does

The skill puts the agent in the role of a file upload specialist. It treats a client-supplied extension as untrustworthy and routes transfers through presigned URLs rather than a server proxy. Large uploads get their own handling so nothing else stalls.

What you get is a table of sharp edges, each with a severity level and a fix. Magic byte checks instead of trusting the declared type, size caps on incoming uploads, filename sanitizing against path traversal, and control over how presigned URLs are handed out. Two of those rows are marked critical. Skip the magic byte check and a renamed file sails right through.

Install it in Claude with `npx claude-code-templates@latest --skill security/file-uploads`. The skill file lands at `~/.claude/skills/file-uploads/SKILL.md`.

## Install

### Claude Code (native platform)

1. **claude-code-templates**
```bash
npx claude-code-templates@latest --skill security/file-uploads
```

2. **Skills CLI (Vercel)**
```bash
npx skills add davila7/claude-code-templates --skill file-uploads -a claude-code
```

3. **Manually: put the files in place**
- File: `~/.claude/skills/file-uploads/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/file-uploads/

### Codex

**Manually: put the files in place**
- File: `.agents/skills/file-uploads/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

**Manually: put the files in place**
- File: `.cursor/skills/file-uploads/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install davila7/claude-code-templates file-uploads
```

2. **Manually: put the files in place**
- File: `.github/skills/file-uploads/SKILL.md`

### Gemini CLI

**Platform CLI**
```bash
gemini skills install https://github.com/davila7/claude-code-templates --path cli-tool/components/skills/security/file-uploads
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/file-uploads/SKILL.md` — The legacy .windsurf/skills/ path still works

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/davila7/claude-code-templates/tree/HEAD/cli-tool/components/skills/security/file-uploads

## When to use it
- accept a large file without stalling the server
- hand a file straight to S3 or R2 with a presigned URL
- verify the real file type instead of the extension
- cap the size of an incoming upload
- block path traversal in a user-supplied filename

## Example prompts
- Set up avatar uploads to Cloudflare R2 with a presigned URL
- Split a video upload into multipart chunks
- Check magic bytes on the uploaded file and reject a spoofed type

## Similar
- [upstash-blob-js](https://affpapa.org/en/nevibecode/skills/upstash-blob-js.md) — skill · 503 installs
- [file-access-vuln](https://affpapa.org/en/nevibecode/skills/file-access-vuln.md) — skill · 3600 installs
- [processing-s3-uploads-with-step-functions](https://affpapa.org/en/nevibecode/skills/processing-s3-uploads-with-step-functions.md) — skill · 5000 installs
- [experience-ui-bundle-file-upload-generate](https://affpapa.org/en/nevibecode/skills/experience-ui-bundle-file-upload-generate.md) — skill · 5200 installs
- [file-storage](https://affpapa.org/en/nevibecode/skills/file-storage.md) — skill · 3100 installs
- [uploads.sh](https://affpapa.org/en/nevibecode/mcp/uploadssh.md) — MCP server · ★ 19

From the same set: [davila7/claude-code-templates](https://affpapa.org/en/nevibecode/by/davila7/claude-code-templates.md) — 495 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md