Package Manifest Check
Compare a downloaded ZIP with a separately trusted file manifest and identify missing, added and changed files without running package code.
Requires: Python 3.10+, a downloaded ZIP, and an expected manifest and hash obtained from a separately trusted release record.
Format: Local Python tool with agent instructions, examples and tests. Not a browser app. MIT licence, version 1.0.0. Git verification is not included.
See exactly what differs
A single archive hash tells you whether two ZIPs are identical. This tool names missing, added and changed files. Packaging dates or compression can differ while the file contents still match.
Try the included example
Extract the complete checker package. From its folder, run:
python scripts/check_package.py examples/changed.zip examples/expected.json --manifest-sha256 a15c1fdef8d8b49cf63f516212ac5fcced81e5f745f80fe1b69d34bb98a63b64The deliberately changed fixture returns MISMATCH: demo/notes.txt is missing, demo/extra.txt is added and demo/SKILL.md is modified. Exit code 1 is expected. The included fixture and hash teach the workflow; they are not independent trust evidence.
Use a real reference
Browse the free-package reference snapshots, or use the manifest for a release you already trust. Never derive the expected manifest from the same untrusted download you are checking.
Understand the result
- MATCH: file bytes agree with the supplied manifest.
- MISMATCH: one or more files differ; legitimate updates can differ too.
- CANNOT_ASSESS: invalid, unsupported or unavailable inputs prevent verification.
No target extraction, execution, installation or network access. Filenames appear in reports and may be sensitive. Hash agreement does not establish publisher identity, malware safety, permissions or host patch status. Review results before deciding what to install.
Continue with the skill security checklist ยท Review instruction-pattern risks