Individual skill

orchardcore-file-upload-security

Skill for securing user-uploaded files in Orchard Core 4.0 with the file upload security pipeline. Covers FileCreationService CreateAsync and CreatedAsync, aborting when FileCreatingResult Succeeded is false, stream ownership and leaveOpen, FileCreatingContext, custom IFileEventHandler checks for extensions, content types or file signatures, handler registration, which features register FileCreationService, the IMediaFileStore CreateFileFromStreamAsync overload taking a FileCreationService, and how Media API uploads, the media recipe step, TUS, deployment imports and XML-RPC use the pipeline. Use this skill when requests mention Orchard Core file upload security, validating, scanning or rejecting uploads, custom upload endpoints, or closely related implementation or troubleshooting work. Strong matches include OrchardCore.FileStorage, FileCreationService, FileCreatingContext, FileCreatingResult, IFileEventHandler, MediaFileStoreExtensions, IMediaFileStore, and FileStoreException.

plugins/orchardcore/skills/orchardcore-file-upload-security/SKILL.md

Read pinned source

Source commit d86d04f234b1b2bd8145368a2544490f9d557596

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: Yes
Repository scan complete: No
Skill scan complete: Yes
Observed behavior: Instructions only
Last checked: Nov 6, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 13
Repository last updated: Oct 21, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

agent-skills Repository topic
ai Repository topic
ai-agents-framework Repository topic
dotnet Repository topic
mcp Repository topic
mcp-server Repository topic
orchardcore Repository topic
writing Derived category
devops Derived category
security Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 16,634 bytes

Read excerpt


# Orchard Core File Upload Security - Prompt Templates

## Run Uploads Through the Pre-Storage Pipeline

You are an Orchard Core expert. Generate code that runs every user-uploaded file through Orchard Core's file upload security pipeline before it is stored permanently, and handlers that inspect or reject those files.

### Guidelines

- `FileCreationService` (namespace `OrchardCore.FileStorage`, package `OrchardCore.FileStorage.Abstractions`) calls every registered `IFileEventHandler.CreatingAsync()` before a file is written, and `CreatedAsync()` after it was stored.
- Call `CreateAsync()` before any permanent write. When the returned `FileCreatingResult.Succeeded` is `false`, abort and do not store the file. Never save first and scan afterwards.
- Store `result.Stream`, not the original upload stream: a handler may have replaced it.
- Call `CreatedAsync()` only after the file was stored successfully, with the stored entry.
- Dispose the result with `await using`, whether it succeeded or failed, and keep it alive while you read `result.Stream`.
- Handlers can also throw (the ClamAV scanner throws `AntivirusScanningException`, a `FileStoreException`, when it cannot scan). Treat an exception as a rejected upload.