Safe Download Verification

Safe Download Verification

Safety boundary

No single check proves a file safe. Never describe an HTTPS URL, a matching hash, a signature, or a zero-detection scan as an absolute safety verdict.

The no-bypass rule is absolute. Never disable, weaken, suppress, override, exclude, allowlist, restore from quarantine, or use “keep anyway” against browser, operating-system, antivirus, EDR, administrator, or organizational protection—temporarily or otherwise. A suspected false positive does not create an exception. Preserve the block and use the vendor's documented false-positive/remediation process, ask the publisher for a corrected signed build, or escalate to the responsible security administrator. If that path is unavailable, do not run the file.

Workflow

1. Start from the publisher's official release or distribution page. Completion: publisher identity and locator are recorded separately from the asset URL.
2. Inspect the redirect chain without executing content. Completion: every host and final status/content type is recorded; unexpected domains stop the process.
3. Download to a quarantine/work directory only after scope approval. Completion: final URL, size, and timestamp are recorded.
4. Compute SHA-256 locally. Compare only with a digest obtained through an independently trusted publisher channel. Mismatch is terminal.
5. Verify a platform signature when available, including signer identity, chain result, and timestamp. Absence is unknown, not automatic failure.
6. Use malware scanning only under the user's privacy and data-sharing policy. Record result and freshness independently; a no-detection result means only that the named scanner reported no detection at that time. Stale or missing evidence blocks execution unless and until complete current evidence is supplied.
7. Report six independent fields: provenance, transport/redirect, integrity, publisher identity, signature, and malware observation. Do not merge one field into another and do not let one field override a failure elsewhere. Platform-protection state is an additional mandatory control field. Completion: every field has a typed PASS, FAIL, or UNKNOWN outcome and the decision is DO_NOT_RUN or EVIDENCE_SUPPORTS_PROCEEDING_UNDER_POLICY. Missing or stale required evidence is insufficient and therefore remains DO_NOT_RUN.

Stop conditions

Hash mismatch, insecure transport, unexpected redirect, invalid signature, inconsistent provenance or publisher identity, opaque repackaging, malware detection, protection warning/block, or unavailable required evidence for a high-impact executable. Every explicit failure dominates every positive field. A hash match proves only byte integrity against the supplied digest. It never cancels another failure and never proves safety.

Fixture

scripts/assess_download.py demonstrates evidence separation with a closed input schema and strict field validation. A matching digest counts as verified integrity only when hash_source is trusted-independent; a digest from the same untrusted channel or an unknown source remains UNKNOWN and blocks execution. Its evidence object preserves provenance, transport/redirect, integrity, publisher identity, signature, malware, and platform-protection observations independently. Unknown fields and malformed types fail closed with structured JSON and exit 3. Explicit evidence failures and missing or stale required evidence return exit 2 / DO_NOT_RUN; only complete positive synthetic evidence returns exit 0 / EVIDENCE_SUPPORTS_PROCEEDING_UNDER_POLICY. Exit 1 is unused. absolute_safety_proven is always false. Run python -B tests/test_assess.py -v. The fixture never downloads or executes files.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: SorryDancer
• Source: SorryDancer/agent-skill
• License: MIT

Install and usage instructions live in the source repository linked above.