{
  "id": "php-session-upload-deserialization-review",
  "name": "PHP Session, Upload & Deserialization Security Review",
  "type": "skill",
  "provider": "php",
  "harnesses": ["claude-code", "cursor", "codex", "gemini", "kiro", "other"],
  "summary": "Skill for reviewing PHP application-security seams: user-reachable unserialize() object injection (allowed_classes is insufficient), session fixation/hijacking hardening (session_regenerate_id, use_strict_mode, cookie flags), and unsafe file-upload handling, each mapped to an OWASP category and the php.net-documented fix.",
  "source_type": "original",
  "official_docs": [
    "https://www.php.net/manual/en/function.unserialize.php",
    "https://www.php.net/manual/en/session.security.php",
    "https://www.php.net/manual/en/features.file-upload.common-pitfalls.php",
    "https://owasp.org/www-project-top-ten/"
  ],
  "security_notes": "Static-review-only skill: Read/Grep/Glob, no execution and no network. Never runs deserialization payloads, uploads, or exploits against any live or staging system. Any credential- or PII-shaped string is a redact-and-flag finding, never echoed. Every unserialize()/session/upload claim is grounded in current php.net documentation, not memory.",
  "last_verified": "2026-07-16",
  "path": "skills/php/php-session-upload-deserialization-review",
  "author": "github: VincentChuWaiChow",
  "version": "0.1.0"
}