# HALOWERK sicherwerk ZIP Archive Inventory Audit

> HALOWERK sicherwerk ZIP Archive Inventory Audit is a paid API for AI agents from sicher.halowerk.com, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-29).

Audits a ZIP archive's central directory to list all entries with sizes and methods, and flags path traversal, duplicate filenames, and zip bomb hazards — without extracting any files.

## Facts

- Endpoint: POST https://sicher.halowerk.com/v1/oss-zip-archive-inventory-audit?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-29
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/halowerk-sicherwerk-zip-archive-inventory-audit-1e4672ea
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_lAU_rgPeYxjAkeH8YrJ4w

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability halowerk-sicherwerk-zip-archive-inventory-audit-1e4672ea -d '<json body>'
```

Example prompt: Before we unpack that user-uploaded ZIP, can you audit its central directory for path traversal entries, duplicate filenames, and zip bomb risk — without actually extracting anything?

## When to prefer this

Choose this endpoint when you need a fast, read-only security pre-flight check on a ZIP archive before unpacking it — especially for user-supplied, third-party, or untrusted ZIPs. It is ideal for CI/CD pipelines, upload gateways, and automated security workflows where you need to detect zip slip, overwrite, or zip bomb hazards without the risk of actually extracting potentially malicious files. Prefer it over generic file scanners when you specifically need structured ZIP central-directory analysis with pinned, reproducible tooling.

## Known failure modes

- Invalid or corrupt ZIP archive returns an error describing the parse failure
- Archive too large to process returns a size limit error
- Non-ZIP file submitted returns a format rejection error
- Network timeout if the archive URL is unreachable
- Missing required input field returns a validation error

## How this service works

Reads the central directory of a supplied ZIP archive with the pinned unzip build and reports what it would do if you unpacked it, without unpacking anything. Every entry is listed with its uncompressed size and method, and three specific hazards are named: paths that climb out of the target directory, names the archive repeats so that a later entry silently overwrites an earlier one, and a total uncompressed size far out of proportion to the archive.

## Output

A structured JSON report listing every entry in the ZIP's central directory with its uncompressed size and compression method, plus three specific hazard flags: (1) path traversal entries whose names escape the target directory, (2) duplicate filenames where a later entry would silently overwrite an earlier one, and (3) a zip bomb indicator when the total uncompressed size is disproportionate to the archive size.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "bodyType"
   ],
   "properties": {
    "type": {
     "const": "http"
    },
    "method": {
     "const": "POST"
    },
    "bodyType": {
     "const": "json"
    },
    "schemaUrl": {
     "type": "string",
     "format": "uri"
    },
    "exampleUrl": {
     "type": "string",
     "format": "uri"
    }
   },
   "additionalProperties": true
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "const": "json"
    },
    "schemaUrl": {
     "type": "string",
     "format": "uri"
    },
    "exampleUrl": {
     "type": "string",
     "format": "uri"
    }
   },
   "additionalProperties": true
  }
 },
 "additionalProperties": true
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/halowerk-sicherwerk-zip-archive-inventory-audit-1e4672ea/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from sicher.halowerk.com](https://www.zero.xyz/host/sicher.halowerk.com/llms.txt)