When your threat model includes distrust of your tools, you can run your tools in a vm then exfiltrate the files from there. perhaps even fingerprint the whole

When your threat model includes distrust of your tools, you can run your tools in a vm then exfiltrate the files from there. perhaps even fingerprint the whole vm to analyze if there were shenanigans afoot in the archive. If your threat model also includes distrust of your vm, which is reasonable, vm's are not the security panacea some try to sell them as. Then yeah, stay away from it. or start investing in throwaway one use machines and depend on the network isolation keeping you safe.