Harden standalone skill archive validation

[dd3ok]

Summary

• validate the exact runtime ZIP as an untrusted archive: paths, entry types and permissions, local/central metadata, canonical physical layout, payload CRC/actual size, disk/version/timestamp fields, and safe bounded diagnostics
• bound ZIP parser work before opening an archive and reject source-tree symbolic links, reparse points, special files, manifest drift, and oversized inputs before temporary packaging
• document the complete release archive contract and add byte-level regressions for the discovered edge cases

Compatibility

• the published v0.4.2 asset still passes and retains SHA-256 522365039a6bacbc45c0fb9d4a3115a8dcf1bb743f072216c115a3add943a39a
• normal Python source packaging, stored/deflated entries, deflated-empty directories, and hard-linked regular-file bytes remain supported

Verification

• python -m unittest discover -s evals -p 'test_*.py' — 205 passed, 1 local Windows symlink-privilege skip (the platform-independent mocked regression passes)
• policy markers, 36 semantic cases, 24 trigger cases, package build/archive checks, release metadata, and both strict WATCHLIST validators pass
• three independent final reviews found no remaining P0–P2 issues

[dd3ok]

Self-review

Reviewed the exact remote head ee60a00f798acd9bc771bdaa7d7af2aff6b2a0df against base 9fb523be217061a8c91bd85f63e486678ed506b2.

Result: no remaining P0–P2 findings.

What I checked

• archive names, alternate-path extra fields, Unix/DOS entry types and readable permissions
• local/central version, flags, method, timestamp, CRC, sizes, and per-entry disk number
• canonical no-prefix/no-gap/no-hidden-record/no-trailing-data physical layout
• bounded parser work plus actual stored/deflated output size, stream boundary, and CRC recomputation
• terminal-safe, length-bounded diagnostics for untrusted names and parser errors
• source preflight does not follow symbolic links/reparse points and rejects special, unexpected, or oversized inputs before payload reads

Side-effect review

• the seven runtime skill files are unchanged
• normal source builds, stored/deflated entries, safe directory modes, deflated-empty directories, and hard-linked regular-file bytes remain accepted
• the published v0.4.2 asset still validates with unchanged SHA-256 522365039a6bacbc45c0fb9d4a3115a8dcf1bb743f072216c115a3add943a39a
• no new non-standard-library dependency was added; the installable runtime remains Python-free

Local verification

• 205 unit tests passed; 1 Windows-only real-symlink creation case skipped for local privilege, while its platform-independent mocked regression passed
• policy markers; 36 semantic and 24 trigger cases; package, release metadata, strict example, and strict template checks all passed
• three independent reviewer passes found no remaining P0–P2 issue

PR CI remains the final Python 3.8/Linux verification gate.

[gemini-code-assist]

Code Review

This pull request significantly hardens the skill package validation and creation process by introducing strict canonical ZIP layout checks, size limits, permission checks, and path safety validation. It adds robust preflight checks, local and central header consistency checks, and payload integrity verification, along with comprehensive unit tests to cover these security boundaries. A review comment points out that the encrypted variable defined in validate_package is unused and should be removed.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The variable encrypted is defined via a list comprehension but is never used anywhere in the function. Since the loop below already checks info.flag_bits & 0x1 individually and appends the appropriate error, this list comprehension is redundant and can be safely removed to clean up the code.

References

1. Unused variables should be removed to maintain clean and readable code, adhering to PEP 8 guidelines. ^(link)