CLI-Anything Bundle #7 — Archive Recon Pack

Four agent-native CLI skills that answer the two questions every agent should settle BEFORE an archive touches disk: arcpeek (what is actually inside this zip/tar — without ever unpacking it), shacheck (can the bytes on arrival be proven against the bytes that shipped), targuard (is this tar safe to extract), zipguard (is this zip safe to extract). Python 3.8+, zero dependencies, Apache 2.0.

Safety contract: all four skills are strictly read-only over everything they inspect. No extraction, no writes, no deletes, no moves, no permission changes, no network. Detection methods and estimates are reported together with how they were decided — never guessed silently. arcpeek reads zip catalog metadata only (and says when a tar is being streamed); unsupported filters like .zst/.lz4 refuse with a clear error instead of a wrong answer.

The pairing that matters

Before extraction: zipguard (+ its tar-side sibling targuard, a different attack surface) — traversal names, absolute paths, link escape, bombs, encrypted members, nested archives.
On arrival: shacheck — pin the bytes at build time (sum → ship the manifest), verify on arrival (verify), CI-grade exit contract you can gate on.
Any time: arcpeek — "what's in there?" without ever unpacking.

1. Unzip

unzip CLI-Anything_Bundle7_ArchiveRecon_v1.0.zip

2. Use with your AI agent

Copy any skill folder (the one containing its SKILL.md) into your agent's skills directory — for OpenClaw that is ~/.openclaw/skills/:

cp -r arcpeek ~/.openclaw/skills/
cp -r shacheck ~/.openclaw/skills/
cp -r targuard ~/.openclaw/skills/
cp -r zipguard ~/.openclaw/skills/

3. Or run as a plain CLI

python3 arcpeek/agent-harness/cli_anything/arcpeek/__main__.py summary bundle.zip
python3 arcpeek/agent-harness/cli_anything/arcpeek/__main__.py dupes bundle.zip
python3 shacheck/agent-harness/cli_anything/shacheck/__main__.py sum file1 file2
python3 shacheck/agent-harness/cli_anything/shacheck/__main__.py verify MANIFEST.sha256 --root .
python3 targuard/agent-harness/cli_anything/targuard/__main__.py report model.tar.gz
python3 zipguard/agent-harness/cli_anything/zipguard/__main__.py report download.zip

4. Add it as a CI gate

Both guard skills and shacheck carry a documented exit contract: 0 = CLEAN / all OK · 1 = RISK or any anomaly (CAUTION counts under --strict) · 2 = operational error. Run them in CI on untrusted intake and let the exit code, not a vibe, stop the pipeline:

python3 zipguard/agent-harness/cli_anything/zipguard/__main__.py report --strict download.zip
python3 targuard/agent-harness/cli_anything/targuard/__main__.py report --strict model.tar.gz
python3 shacheck/agent-harness/cli_anything/shacheck/__main__.py verify MANIFEST.sha256

Verify before you trust (self-test batteries inside)

38 + 28 + 31 + 31 = 128 checks, 0 failed (verified live 2026-10-18):

python3 arcpeek/agent-harness/cli_anything/arcpeek/tests/test_core.py     # 38 checks
python3 shacheck/agent-harness/cli_anything/shacheck/tests/test_core.py   # 28 checks
python3 targuard/agent-harness/cli_anything/targuard/tests/test_core.py   # 31 checks
python3 zipguard/agent-harness/cli_anything/zipguard/tests/test_core.py   # 31 checks

zipguard's battery includes a hand-crafted raw central-directory fixture whose member name contains a NUL byte — exactly the hostile-archive case ZG003 exists for (modern zipfile sanitizes NUL names on both write and read; zipguard reads the raw central directory so the check actually fires).

Command surfaces

skill	commands
arcpeek	`summary PATH [--json]` · `members PATH [--limit N] [--json]` · `dupes PATH [--json]` · `tree PATH [--json]`
shacheck	`sum PATHS... [--binary] [--json]` · `verify MANIFEST [--root DIR] [--unlisted] [--json]`
targuard	`report PATH [--threshold N] [--strict] [--json]` · `names PATH [--json]` — checks TG001–TG007
zipguard	`report PATH [--threshold N] [--strict] [--json]` · `names PATH [--json]` — checks ZG001–ZG009

License

Apache 2.0. Yours to run, modify, and ship anywhere — including inside your own products.

The family (always free on the rail)

tikkunolam.today/downloads — Bundle #1 (49-skill catalog), Bundles #2–#6 (Agent Ops, System Truth, Disk Recon, Log Ops, Format Recon), the Builder Pack, and this README.