Before AI unpacks a ZIP, inspect the names inside it

Request a contents list first. A member name containing a parent-directory step or an absolute path needs review before extraction.

Python’s ZIP documentation advises inspecting untrusted archives before extraction and notes that its extraction functions attempt to prevent paths escaping the destination. Do not assume every tool or AI-written script handles names in the same way.

Our three-entry fixture

We created a tiny fictional ZIP containing notes/readme.txt, ../outside-demo.txt and /absolute-demo.txt. Reading its metadata returned all three names. Our limited POSIX-path check flagged the parent-directory and absolute-path entries for review. Nothing was extracted.

Ask for a preview without unpacking

Suggested input: “List member names and declared compressed and uncompressed sizes without extraction. Flag absolute paths and parent-directory components. Show the intended destination and wait for review before writing files.” Use a tool you trust to inspect the archive rather than relying only on AI’s assurance.

Keep the path and size questions separate

A normal-looking name does not establish harmless content or a manageable expanded size. Review the contents, required space and whether extraction could replace existing files. An unexpected path is a review signal, not proof that the archive is malicious.

Our example is not a complete scanner

The fixture checks only three simple POSIX-style names. It does not test Windows drive paths, backslashes, links, encrypted members, malformed archives or an extractor’s defenses. Do not paste this toy check into production as a complete safety test.

Published October 14, 2026. We created and listed one original ZIP with Python 3.11.3. No extraction, overwrite, AI operation, malware execution or user archive access occurred.

Sources: Python · ZIP files.