carto-arcgis-migration

The code describes a legitimate ArcGIS-to-GeoParquet extraction workflow and shows no clear malicious behavior. It contains a meaningful security vulnerability in the Shapefile ZIP handling: unvalidated archive member names passed to ZipFile.extract() can enable Zip Slip path traversal when processing a malicious archive. Token query-string exposure and shared temporary files are additional security weaknesses. Use safe archive extraction with canonical-path checks, avoid URL tokens where supported, use secure unique temporary files, validate manifest inputs, and verify downloaded content before processing.