Is This File Safe? True Type, Macros, PDF JavaScript & Metadata

Checks files before an AI agent, RAG pipeline or upload form opens them and returns one verdict per file: safe, review or block. It finds the true file type from the bytes (not the extension), Office macros, PDF JavaScript and launch actions, archive bombs, embedded files and hidden author or GPS metadata.

Built for people who feed untrusted files into pipelines: RAG and agent builders, upload services, e-discovery and security teams. Files are only read and parsed. They are never executed, opened by Office or a PDF reader, or saved to disk.

Input examples

Check a few files by URL:

{ "fileUrls": ["https://example.com/report.pdf", "https://example.com/invoice.docx", "https://example.com/photo.jpg"] }

Check everything a Website Content Crawler run saved, and treat every macro as a block:

{ "keyValueStoreId": "CRAWLER_STORE_ID", "macroPolicy": "block", "maxFiles": 300 }

Check the file URLs in a dataset column:

{ "datasetId": "YOUR_DATASET_ID", "urlField": "url", "blockExecutables": false }

Leave the input empty to inspect 8 built-in demo files (a PDF with auto-run JavaScript, an EXE named .jpg, a macro workbook named .xlsx, a 60 MB bomb, clean files).

Input guide

Field	What it does
fileUrls	Public http(s) file URLs.
keyValueStoreId, recordKeys	Inspect records of a key-value store (all records by default).
datasetId, urlField	Inspect file URLs listed in a dataset column.
macroPolicy	review (default) or block for macros without clearly malicious behaviour.
blockExecutables	Flag executables and scripts; block them when the name claims to be harmless.
maxFileMb, maxFiles	Size and count limits. Larger files are inspected up to the limit and marked for review.

How the verdict works

Verdict	Examples
block	EXE/ELF/script disguised as .jpg or .txt; PDF JavaScript that runs on open (/OpenAction, /AA, /Launch); VBA that auto-runs and calls shell, download or PowerShell; DDE fields; decompression bombs, overlapping zip entries, zip-slip paths; SVG with scripts
review	Any macro; PDF with JavaScript, embedded files, forms that submit, encryption; type does not match extension; external template or linked OLE content; ActiveX; GPS in photos; data appended after an image; encrypted or nested archives; very high compression ratios
safe	Nothing above found. This is not a guarantee of safety.

Output

One row per file.

Field	Meaning
verdict, reasons, reasonCodes	The decision and every finding in plain words
detectedType, claimedExtension, typeMismatch	True type from magic bytes vs the file name
macros	VBA modules, auto-run entry points, suspicious calls (Office files)
pdf	Counts of risky PDF keywords, pages and Info metadata
archive	Entry count, unpacked size, ratio, nested archives, executables inside
metadata	Author, last editor, company, software, camera and GPS where present
sha256, sizeBytes	Fingerprint and size

Sample row (shortened):

{ "type": "file", "name": "quarterly-report.pdf", "verdict": "block", "detectedType": "pdf", "typeMismatch": false,
  "reasons": ["[block] PDF contains JavaScript that runs automatically (/JavaScript 2, /OpenAction 1, /AA 0)"],
  "pdf": { "keywords": { "javascript": 2, "openAction": 1, "pages": 1 } }, "sha256": "..." }

Use it with

• Website Content Crawler (saves downloaded files in its key-value store) -> this Actor -> only ingest files with verdict: "safe" into your vector store.
• An agent tool: call the Actor with the URL the agent was about to download and branch on verdict.
• Any scraper that outputs a url column of documents -> this Actor with datasetId.

FAQ

Does it run antivirus? No. It is a static triage of known risk patterns, similar to oletools and pdfid. It does not use signature databases, so brand-new malware that avoids these patterns can pass as safe.

Does it open or execute the file? Never. Bytes are parsed in memory.

What about password-protected files? They are flagged for review because their contents cannot be inspected.

Honest limits

• Not an antivirus. Treat safe as "no known red flags", not "clean".
• Macro source is decoded for standard VBA projects; heavily obfuscated or stomped VBA, and Excel 4.0 macros inside OOXML sheets, are detected only by structure.
• Archives are checked from their directory (sizes, names, overlap). 7z, rar, bz2, xz and tar contents are not unpacked; gzip is checked by its size footer.
• Images: only JPEG/TIFF/HEIC/WebP EXIF is read for GPS; PNG text chunks are not.
• Files are held in memory (default limit 25 MB).

Price

Pay per event: $0.002 per file inspected (file-inspected). 1,000 files cost $2.00. Files that cannot be downloaded or read are not charged.