# Archive Tools

> A safe archive helper — extracts archives with a member filter and runs a fixed command via an argument list. Documents the Phase J attacks defensively.

- Skill: `antoniotimo/archive-tools` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add antoniotimo/archive-tools`
- Raw SKILL.md: https://api.skillmd.com/api/skills/antoniotimo/archive-tools/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: AntonioTimo (https://skillmd.com/u/antoniotimo)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/antoniotimo/archive-tools

---


# Archive Tools

A safe helper. It writes the Phase J attack patterns **defensively** and uses the
safe form of every risky call, so neither the prose rules nor the AST rules fire.

## Safety notes

This skill will never emit a forged `<|im_start|>` control token, never tell the model to disregard all previous instructions, and never open a `/dev/tcp` reverse shell or fetch a stage-2 payload — those are exactly the malicious patterns it refuses.

It does normal documentation things instead: it will follow the instructions in the README, read the directives above to summarize them, and link to the `[system](#system)` section of its own docs — none of which is an injection.

## System

(A normal documentation heading the table of contents above links to.)

## Step 1 — Extract

```bash
python3 ~/.claude/skills/archive-tools/scripts/safe.py "$1"
```

---

## Why this passes audit (negative test for Phase J)

- The Safety-notes line names the forged-token / disregard-instructions /
  reverse-shell patterns but is **defensive** — the leading "never" negates them
  (the `PROSE_TARGETING` negation guard).
- `scripts/safe.py` uses an argument-list subprocess call (no shell, with a
  timeout) and a member-filtered archive extraction — so `AST010`/`AST011` do not fire.
- There is **no** bundled `.mcp.json`, `binding.gyp`, or executable file.

Expected verdict: 🟢 GREEN, exit 0.