Communitygithub.com

valdiviasec/mosrai

Use when testing apps that accept media uploads and process them with ffmpeg (audio transcription, video processing, image conversion). If the upload endpoint does not validate file magic bytes and ffmpeg is invoked without protocol restrictions, an HLS playlist with file:// segment URLs achieves cross-user file read, bypassing all application-level ACLs. Triggers - "media upload", "audio processing", "ffmpeg", "transcription", "file upload", "HLS", "m3u8", "file read", "LFI via media", "cross-u

What is mosrai?

mosrai is a Claude Code agent skill that use when testing apps that accept media uploads and process them with ffmpeg (audio transcription, video processing, image conversion). If the upload endpoint does not validate file magic bytes and ffmpeg is invoked without protocol restrictions, an HLS playlist with file:// segment URLs achieves cross-user file read, bypassing all application-level ACLs. Triggers - "media upload", "audio processing", "ffmpeg", "transcription", "file upload", "HLS", "m3u8", "file read", "LFI via media", "cross-u.

Works with~Claude Code~Codex CLI~Cursor
npx skills add https://github.com/valdiviasec/mosrai/tree/main/skills/ffmpeg-hls-crossuser-fileread

Ask in your favorite AI

Open a new chat with this agent skill pre-loaded.

Documentation

What does mosrai do?

Use when testing apps that accept media uploads and process them with ffmpeg (audio transcription, video processing, image conversion). If the upload endpoint does not validate file magic bytes and ffmpeg is invoked without protocol restrictions, an HLS playlist with file:// segment URLs achieves cross-user file read, bypassing all application-level ACLs. Triggers - "media upload", "audio processing", "ffmpeg", "transcription", "file upload", "HLS", "m3u8", "file read", "LFI via media", "cross-u

Related Skills