Skip to content
cccskills
FreePublished on GitHub

file-uploads

File upload decision guide: signed URLs, validation, storage, virus scanning, image processing, UX. Use for: upload, file storage, attachment, avatar, image, document, GCS, S3, presigned.

The English summary is being prepared. Showing the original description.

SebastianLuser/claude-code-arcane3 stars(GitHub 3 + cccskills 0)
Works withAWS

Run score Not tested

See how to install

Files included (1)

  • SKILL.md3.8 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

file-uploads — Decision Guide

Default storage: GCS. Logic identical for S3/R2 — adapt provider SDK.

Upload Strategy Decision

StrategyWhenTrade-off
Signed URL (direct)Default for all uploadsBackend never touches bytes; scales trivially
Server proxy<100KB parsed inline (small CSV)Simple but consumes backend RAM; no scale
Resumable/multipart>100MB (videos, datasets)8-32MB chunks; resume on failure
tus protocolVendor-neutral resumableRequires tusd server

Signed URL Flow

Client → POST /uploads/sign → Backend (validate, create pending row, return signed URL)
Client → PUT bytes → Storage (uploads-pending/)
Storage → Event (Pub/Sub) → Worker (MIME sniff + virus scan)
Worker → if clean: move to uploads-clean/, update DB status

Key decisions:

  • Backend never touches bytes — only signs and tracks
  • Two buckets: uploads-pending (quarantine) + uploads-clean (served)
  • Key is UUID, never client filename (PII, collisions, path traversal)
  • Signed URL expiry: <=15min; include content-length constraint in signature
  • Multi-tenant: t/{tenant}/u/{user}/{uuid} key path

Checklist

CheckWhereDetail
MIME whitelistSign + Worker (sniff)Whitelist only; sniff first 512 bytes server-side
Size limitSign + URL constraintEnforce per use case (10MB avatar, 100MB doc)
Virus scanWorker (async)ClamAV / Cloudmersive / VirusTotal; never serve status != clean
Content-Type matchWorkerSniffed vs declared; reject on mismatch
ChecksumWorker (post-scan)SHA-256 stored for integrity

Never trust client Content-Type or file extension alone.

Storage Decision

ProviderWhenNotes
GCSDefault (GCP)V4 signed URLs, Pub/Sub, Cloud CDN
S3AWS stackPresigned URLs, EventBridge, CloudFront
R2Egress-sensitiveS3-compatible, zero egress fees

Image Processing

  • On upload (worker): predictable sizes — avatars, thumbnails
  • On demand (CDN): many sizes — Cloudflare Images or imgproxy
  • Always WebP/AVIF for delivery; generate thumbnails async, never in request

Status Machine

pending → scanning → clean | infected (deleted) | rejected (deleted)

DB columns: id, owner_id, tenant_id, bucket, key, mime, size, checksum_sha256, status, scanned_at, created_at.

UX Patterns

  • Progress (web): XHR upload.onprogress — fetch lacks upload progress
  • Progress (RN): expo-file-system uploadAsync
  • 100MB: switch to resumable with per-chunk retry + exponential backoff

  • Show placeholder until status=clean; poll or WebSocket for completion

Anti-patterns

  • Proxying bytes through backend — wastes RAM, crashes pods
  • Trusting extension or client Content-Type without server sniff
  • Client filename as key — PII, collisions, traversal
  • Serving pending/scanning files; sync virus scan in request
  • Signed URLs >15min; no size limit; any-MIME allowed
  • Public buckets; missing CORS; no rate limit on /uploads/sign

Checklist

  • Signed URL <=15min; content-length in signature
  • MIME whitelist at sign AND worker (real sniff)
  • UUID key, never client filename
  • Separate pending/clean buckets; virus scan before serving
  • DB status machine (pending→scanning→clean)
  • SHA-256 checksum post-scan; CORS on bucket
  • Rate limit on /uploads/sign; tenant_id in path
  • Thumbnails async; CDN for clean files; structured logs

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

Plan, design, and implement A/B tests and experiments with statistical rigor. Covers hypothesis frameworks, sample sizing, metrics, and result analysis.

The English summary is being prepared. Showing the original description.

SebastianLuser/claude-code-arcane3Updated Oct 27, 2026

Web/mobile accessibility decision guide: WCAG 2.2 AA, ARIA, keyboard nav, focus management, contrast, testing. Use for: a11y, accessibility, wcag, aria, screen reader, keyboard, contrast.

The English summary is being prepared. Showing the original description.

SebastianLuser/claude-code-arcane3Updated Oct 27, 2026

Generate, iterate, and scale ad creative for paid advertising across Google, Meta, LinkedIn, and X. Covers platform specs, creative frameworks, and quality validation.

The English summary is being prepared. Showing the original description.

SebastianLuser/claude-code-arcane3Updated Oct 27, 2026

Musica interactiva para juegos: layering vertical, re-secuenciacion horizontal, stingers, reglas de transicion con sync points, y mapeo de estados de gameplay a musica. Usar para: musica adaptativa, sistema de musica dinamica, transiciones musicales, combat music.

The English summary is being prepared. Showing the original description.

SebastianLuser/claude-code-arcane3Updated Oct 27, 2026

Design multi-agent systems, create agent architectures, define communication patterns, and build autonomous agent workflows with structured evaluation frameworks.

The English summary is being prepared. Showing the original description.

SebastianLuser/claude-code-arcane3Updated Oct 27, 2026

Inter-agent communication protocol for C-suite agent teams. Defines invocation syntax, loop prevention, isolation rules, response formats, and quality loops.

The English summary is being prepared. Showing the original description.

SebastianLuser/claude-code-arcane3Updated Oct 27, 2026

See all skills by SebastianLuser

Report a problem with this skill