version: "1.0.1" name: archive-file-triage description: Use file, 7z, unzip, tar-compatible tools, hashes, and bounded shell inspection for safe triage of provided archives and unknown files.

archive-file-triage

Use local file and archive tools for safe triage of provided archives, unknown files, evidence bundles, source packages, firmware packages, and extracted artifacts.

Help First

Before constructing commands, use installed help or version output as the source of truth:

file --help
7z i
unzip -h
tar --help

Usage Rules

• Work only on explicitly provided files or task-scoped outputs.
• Identify file type and size before extraction.
• Extract only into a task-scoped output directory.
• Preserve original files and record hashes when identity matters.
• Prefer listing archive contents before extraction.
• Do not execute extracted content.
• Watch for path traversal, absolute paths, symlinks, excessive file counts, nested archives, and unexpectedly large expansion.
• Save large listings and extraction logs to files rather than streaming them into the conversation.

Common Workflows

Identify and hash before extraction:

file artifact.bin
sha256sum artifact.bin

List archive contents first:

7z l archive.7z
unzip -l archive.zip
tar -tf archive.tar

Extract into a task-scoped directory:

mkdir -p extracted
7z x archive.7z -oextracted
unzip archive.zip -d extracted
tar -xf archive.tar -C extracted

After extraction, inspect file types before any deeper analysis:

find extracted -maxdepth 2 -type f -exec file '{}' +

Output

Report the input path, type, size, hashes when relevant, command used, output directory, notable extracted paths, suspicious archive behavior, and limitations.