# Safe Download Verification > Use when assessing a download URL or file before execution. Separate source provenance, transport, integrity, publisher identity, signature evidence, and malware observations; stop on mismatches and never disable platform protections. - **Type:** Skill - **Install:** `agentstack add skill-sorrydancer-agent-skill-safe-download-verification` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [SorryDancer](https://agentstack.voostack.com/s/sorrydancer) - **Installs:** 0 - **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [SorryDancer](https://github.com/SorryDancer) - **Source:** https://github.com/SorryDancer/agent-skill/tree/main/skills/software-development/safe-download-verification ## Install ```sh agentstack add skill-sorrydancer-agent-skill-safe-download-verification ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # Safe Download Verification ## Safety boundary No single check proves a file safe. Never describe an HTTPS URL, a matching hash, a signature, or a zero-detection scan as an absolute safety verdict. The no-bypass rule is absolute. Never disable, weaken, suppress, override, exclude, allowlist, restore from quarantine, or use “keep anyway” against browser, operating-system, antivirus, EDR, administrator, or organizational protection—temporarily or otherwise. A suspected false positive does not create an exception. Preserve the block and use the vendor's documented false-positive/remediation process, ask the publisher for a corrected signed build, or escalate to the responsible security administrator. If that path is unavailable, do not run the file. ## Workflow 1. Start from the publisher's official release or distribution page. Completion: publisher identity and locator are recorded separately from the asset URL. 2. Inspect the redirect chain without executing content. Completion: every host and final status/content type is recorded; unexpected domains stop the process. 3. Download to a quarantine/work directory only after scope approval. Completion: final URL, size, and timestamp are recorded. 4. Compute SHA-256 locally. Compare only with a digest obtained through an independently trusted publisher channel. Mismatch is terminal. 5. Verify a platform signature when available, including signer identity, chain result, and timestamp. Absence is unknown, not automatic failure. 6. Use malware scanning only under the user's privacy and data-sharing policy. Record result and freshness independently; a no-detection result means only that the named scanner reported no detection at that time. Stale or missing evidence blocks execution unless and until complete current evidence is supplied. 7. Report six independent fields: provenance, transport/redirect, integrity, publisher identity, signature, and malware observation. Do not merge one field into another and do not let one field override a failure elsewhere. Platform-protection state is an additional mandatory control field. Completion: every field has a typed `PASS`, `FAIL`, or `UNKNOWN` outcome and the decision is `DO_NOT_RUN` or `EVIDENCE_SUPPORTS_PROCEEDING_UNDER_POLICY`. Missing or stale required evidence is insufficient and therefore remains `DO_NOT_RUN`. ## Stop conditions Hash mismatch, insecure transport, unexpected redirect, invalid signature, inconsistent provenance or publisher identity, opaque repackaging, malware detection, protection warning/block, or unavailable required evidence for a high-impact executable. Every explicit failure dominates every positive field. A hash match proves only byte integrity against the supplied digest. It never cancels another failure and never proves safety. ## Fixture `scripts/assess_download.py` demonstrates evidence separation with a closed input schema and strict field validation. A matching digest counts as verified integrity only when `hash_source` is `trusted-independent`; a digest from the same untrusted channel or an unknown source remains `UNKNOWN` and blocks execution. Its `evidence` object preserves provenance, transport/redirect, integrity, publisher identity, signature, malware, and platform-protection observations independently. Unknown fields and malformed types fail closed with structured JSON and exit 3. Explicit evidence failures and missing or stale required evidence return exit 2 / `DO_NOT_RUN`; only complete positive synthetic evidence returns exit 0 / `EVIDENCE_SUPPORTS_PROCEEDING_UNDER_POLICY`. Exit 1 is unused. `absolute_safety_proven` is always false. Run `python -B tests/test_assess.py -v`. The fixture never downloads or executes files. ## Source & license This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [SorryDancer](https://github.com/SorryDancer) - **Source:** [SorryDancer/agent-skill](https://github.com/SorryDancer/agent-skill) - **License:** MIT Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** no - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/skill-sorrydancer-agent-skill-safe-download-verification - Seller: https://agentstack.voostack.com/s/sorrydancer - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.