{"data":{"status":"fail","checked":6,"targets":["windows","macos","linux"],"findings":[{"rule":"zip-slip-backslash","severity":"error","index":5,"path":"..\\..\\evil.dll","detail":"Treating \"\\\" as a separator (Windows extractors do) the path climbs above the extraction root at component 0; POSIX extractors keep it as a literal character."},{"rule":"case-collision","severity":"error","index":2,"path":"app/Run.sh","detail":"Entries 1, 2 are one file on windows; the last one overwrites the earlier. Also on macos.","target":"windows"},{"rule":"write-through-symlink","severity":"error","index":4,"path":"app/link/passwd","detail":"Entry 3 (app/link) is a symlink; extracting this entry after it writes through the link, to wherever it points."},{"rule":"link-target-escape","severity":"error","index":3,"path":"app/link","detail":"symlink target ../../etc resolves above the extraction root."}],"findingCount":4,"witnesses":[{"ruleId":"zip-slip-backslash","detail":"Treating \"\\\" as a separator (Windows extractors do) the path climbs above the extraction root at component 0; POSIX extractors keep it as a literal character.","path":"..\\..\\evil.dll","index":5},{"ruleId":"windows:case-collision","detail":"Entries 1, 2 are one file on windows; the last one overwrites the earlier. Also on macos.","path":"app/Run.sh","index":2,"actual":["app/run.sh","app/Run.sh"]},{"ruleId":"write-through-symlink","detail":"Entry 3 (app/link) is a symlink; extracting this entry after it writes through the link, to wherever it points.","path":"app/link/passwd","index":4,"expected":"no entry below a link","actual":"app/link"},{"ruleId":"link-target-escape","detail":"symlink target ../../etc resolves above the extraction root.","path":"app/link","index":3,"actual":"../../etc"}],"versions":{"engine":"archive-preflight 1","windows-naming":"learn.microsoft.com/windows/win32/fileio/naming-a-file, ms.date 2024-08-28, fetched 2026-11-04","windows-path-limits":"learn.microsoft.com/windows/win32/fileio/maximum-file-path-limitation, fetched 2026-11-04","linux-limits":"torvalds/linux include/uapi/linux/limits.h NAME_MAX=255 PATH_MAX=4096, fetched 2026-11-04","macos-limits":"apple-oss-distributions/xnu bsd/sys/syslimits.h NAME_MAX=255 bytes PATH_MAX=1024 bytes, fetched 2026-11-04","apfs-reference":"Apple File System Reference 2020-06-22 (case and normalization insensitivity flags, NFD name hash), fetched 2026-11-04","zip-appnote":"PKWARE APPNOTE: entry names use forward slashes; backslash handling is extractor-specific, so both readings are checked"},"limits":["Manifest-only: contents, permissions, setuid bits and extractor-side sanitising are not seen.","A symlink chain through other symlinks is not resolved beyond the direct ancestor and target checks."],"deterministic":true},"_provenance":{"version":"writerslogic-provenance/1","issuer":"did:web:agents.writerslogic.com","verify":{"endpoint":"POST /api/v1/verify-provenance","did":"did:web:agents.writerslogic.com"},"manifest":{"format":"application/json","instance_id":"xmp:iid:49c1e02e-5607-46eb-a29f-42afcbfcb2ea","claim_generator_info":[{"name":"WritersLogic x402 Agent Hub","version":"2.0.0"}],"title":"Archive extraction preflight: zip-slip, duplicate destinations, symlink conflicts","assertions":[{"label":"c2pa.actions.v2","data":{"actions":[{"action":"c2pa.created","when":"2026-11-06T01:30:30.129Z","softwareAgent":{"name":"writerslogic-agent-hub/archive-preflight","version":"2.0.0"},"digitalSourceType":"http://cv.iptc.org/newscodes/digitalsourcetype/algorithmicMedia","parameters":{"endpoint":"POST /api/v1/archive-preflight","inputDigest":{"alg":"sha256","hash":"d8f9f8c0a2ee24ce295e266fa98558f2eb45c81921d9581a26d81d9dda43bc9a","canonicalization":"JCS"}}}]}},{"label":"c2pa.hash.data","data":{"alg":"sha256","hash":"440a81897773af7399836381eb9673fd4374074534009a92634d5b48a9f2cb8d","name":"jcs-canonical-json(data)"}}]},"credential":{"@context":["https://www.w3.org/ns/credentials/v2"],"id":"urn:uuid:b850fb3c-9e0a-4099-8cb4-2dc1541273b0","type":["VerifiableCredential","AgentOutputCredential"],"issuer":"did:web:agents.writerslogic.com","validFrom":"2026-11-06T01:30:30.129Z","credentialSubject":{"id":"urn:sha256:440a81897773af7399836381eb9673fd4374074534009a92634d5b48a9f2cb8d","agent":"archive-preflight","endpoint":"POST /api/v1/archive-preflight","outputDigest":{"alg":"sha256","value":"440a81897773af7399836381eb9673fd4374074534009a92634d5b48a9f2cb8d","canonicalization":"JCS"},"inputDigest":{"alg":"sha256","value":"d8f9f8c0a2ee24ce295e266fa98558f2eb45c81921d9581a26d81d9dda43bc9a","canonicalization":"JCS"},"manifestDigest":{"alg":"sha256","value":"e1421b578bf205484fcf8e4f94123f517c10342154a71247fbf11f88048c79e1","canonicalization":"JCS"},"ingredients":[],"payment":{"scheme":"api-key","network":"eip155:8453","payer":"sample"}},"proof":{"type":"DataIntegrityProof","cryptosuite":"eddsa-jcs-2022","created":"2026-11-06T01:30:30.129Z","verificationMethod":"did:web:agents.writerslogic.com#key-1","proofPurpose":"assertionMethod","proofValue":"z3PBJzzVF3gzfEbDeUGnJGZxU2X7C5Z9C1GyY8KhyQbjKFGB3vSskW14XYNjBpvgGMZzoDc9TBEyaEDiqxB6mHA76"}},"ethSignature":{"type":"EIP-191","signer":"did:pkh:eip155:8453:0x3DBd42560cA7a7E448A2c7DfC9E785526189411f","address":"0x3DBd42560cA7a7E448A2c7DfC9E785526189411f","message":"writerslogic-provenance:ff2edbf6cdc4964115e3d1ee69dbee5cd4b733ea86172a098019051925aa544e","signature":"0xab4e640e218532da48f5ccee98c11eba602cb7935b9a38f02ba1ad418a0cde876f45bbaf2fb400c0c5efc95aa5863ec7a8db044ec74a7da272ecf7b77565baf51b"}}}