{"version":"2.1.228","anchor":"downloaded-skill-archives-are-inspected-before-extraction","canonical_anchor":"downloaded-skill-archives-are-inspected-before-extraction","heading":"Downloaded skill archives are inspected before extraction","tier":"notice","area":"Skills","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.228\/e\/downloaded-skill-archives-are-inspected-before-extraction","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.228","markdown":"### Downloaded skill archives are inspected before extraction\n\nDownloaded skill archives are checked before unpacking so they cannot write outside the skills folder.\n\n**What**\n\nThe path that downloads a session's skills now checks the archive before unpacking it, so a malicious or malformed bundle cannot write outside the skills directory.\n\n**Details**\n\n- Zip versus tar is detected by magic bytes rather than filename.\n- The archive is listed first and refused outright if any member has an absolute path or a `..` component, or is a symlink, hardlink or device entry.\n- Extraction goes to a staging directory, and a skill whose name would resolve outside the `skills` directory is refused.\n- The skill version must resolve to a concrete numeric version before the download starts.\n- Reached only through the environment worker's skill setup.\n\n**Evidence**\n\n`refusing to extract archive with symlink\/hardlink\/device member`\n\n- Area: Skills\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5"}