How long does the integration take?

Change one base URL in an OpenAI-compatible client, or install the Python or TypeScript SDK; the quickstart routes a first request in a few minutes.

Will this lock us into another vendor?

No. The router is Apache-2.0 open source, your provider keys stay yours, and the API is OpenAI-compatible, so leaving is a change of base URL.

What happens when a provider fails?

The router falls back to the next model your policy allows and records the fallback in the trace, so an outage costs a retry, not an incident.

file-access-vuln - Skill - OpenSmartRoute

Name: file-access-vuln
Author: yaklang

Imported from yaklang/hack-skills (skills/file-access-vuln/SKILL.md) via skills.sh. Install upstream with npx skills add yaklang/hack-skills --skill file-access-vuln. Copyright stays with the author.

File Access Router

This is the routing entry point for filesystem paths, download endpoints, upload pipelines, and file preview handling.

When to Use

Parameters, filenames, download endpoints, or import flows influence file paths
The target supports upload, preview, transcoding, extraction, sharing, download, or proxied file access
You need to decide whether this is path traversal/LFI or an upload-validation/processing-chain issue

Skill Map

Path Traversal LFI: path traversal, file read, wrapper abuse, include chains
Upload Insecure Files: upload validation, storage paths, processing chains, overwrite risk, preview/share boundaries

Recommended Flow

First identify whether the entry point is a path parameter, download endpoint, or upload workflow
Then locate whether the issue appears in accept, store, process, or serve stages
Small path-chain and upload-bypass samples are merged into the main topic skills; no separate payload entry is needed

Related Categories

# after Install: the listing is in your workspace's routing pool - a plan picks it for its slot curl -s -X POST https://osr-api.kindrock-caaab1a2.centralindia.azurecontainerapps.io/api/v1/route -H 'Authorization: Bearer $OSR_API_KEY' -H 'Content-Type: application/json' -d '{"text": "...", "plan": true}'

Install file-access-vuln and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "yaklang-hack-skills-file-access-vuln", "kind": "skill", "name": "file-access-vuln", "description": "Entry P1 category router for file access and upload workflows. Use when testing download endpoints, file paths, local file inclusion, upload flows, preview pipelines, archive extraction, or storage and sharing boundaries.", "publisher": "yaklang", "version": "1.0.0", "capabilities": { "domains": [ "coding" ], "tags": [ "skill-md", "skills-sh" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Entry P1 category router for file access and upload workflows. Use when testing download endpoints, file paths, local file inclusion, upload flows, preview pipelines, archive extraction, or storage and sharing boundaries." ], "primary": false, "metadata": { "source": { "provider": "skills.sh", "repository": "https://github.com/yaklang/hack-skills", "path": "skills/file-access-vuln/SKILL.md", "ref": "HEAD", "url": "https://www.skills.sh/yaklang/hack-skills/file-access-vuln", "key": "yaklang/hack-skills/skills/file-access-vuln/SKILL.md" } }, "instructions": "# File Access Router\n\nThis is the routing entry point for filesystem paths, download endpoints, upload pipelines, and file preview handling.\n\n## When to Use\n\n- Parameters, filenames, download endpoints, or import flows influence file paths\n- The target supports upload, preview, transcoding, extraction, sharing, download, or proxied file access\n- You need to decide whether this is path traversal/LFI or an upload-validation/processing-chain issue\n\n## Skill Map\n\n- [Path Traversal LFI](../path-traversal-lfi/SKILL.md): path traversal, file read, wrapper abuse, include chains\n- [Upload Insecure File", "cost": { "context_tokens": 299 } }

file-access-vuln

About

File Access Router

When to Use

Skill Map

Recommended Flow

Related Categories

Use it

Install file-access-vuln and it becomes one more candidate the router can pick - when it fits.

What it costs to adopt - in engineering time.

One base URL

No vendor lock-in

Failover built in

Manifest

Reviews