SIS CLI
Format Coverage Guide
Format is derived from bytes and structure, not the suffix. A claimed extension is a hint; a selected primary format is not proof that the bytes have only one interpretation. Root and nested content use the same analysis entry point within traversal and resource limits.
Registered native root families
These tags describe native routing in the root registry, not a promise that every operation/provider is complete for every format:
| Family | Canonical root tags |
|---|---|
| Documents | pdf, ooxml, rtf, one |
| Markup and stylesheets | html, hta, xml, svg, css |
| Messages | mht, eml, msg |
| Compound documents | ole2 |
| Shortcuts | lnk, url, scf, desktop |
| Executables | pe, elf, macho |
| Archives and images of filesystems | iso, zip, 7z, rar, tar, compressed_stream |
| Scripts | js, vbs, ps1, sh, wsf, vba, py, applescript |
| Structured text | json, yaml, toml, md |
| Images | png, jpeg, gif, bmp, tiff, webp, jp2 |
| Fonts and media | font, media, swf |
Both standalone CSS stylesheet roots (.css) and standalone LESS stylesheet roots (.less) share the css route. Office extensions and package traits can share physical container bytes; do not treat the extension as the format authority.
What support does and does not establish
- Recognition/routing: a format interpretation was selected or structurally admitted.
- Native analysis: that route can produce observations/findings; absence is bounded by its actual analysis coverage.
- Member materialisation: bytes were decoded/decrypted/extracted successfully. RAR recognition and archive analysis do not currently imply supported RAR member extraction.
- Text extraction: supported channels were recovered. Some routes have limited or raw-byte fallback text rather than faithful human-visible rendering.
- Transformation: selected CDR operations can produce a derivative. It is not implied by scan support.
- Optional providers: decoder, OCR, ML or runtime execution availability and participation are separate build/policy facts.
Non-ISOBMFF media (media-legacy-container: AVI/WAV/MP3/MKV/WebM) is recognised but lacks a native structural route. Unrecognised content, compressed-stream classifications without a native root route, encryption, malformed structures and resource limits must be treated as limits/omissions where reported, not as benign evidence. Structural indicators in image/media/font analysis are not proof that a particular application is exploitable.
Inspect one input
sis scan sample.html --format json --emit json=report.json
sis explain detection sample.html --json
sis explain members sample.html --json
sis query '**' --from-report report.json --format json
Read root_support, analysis_coverage, provider_participation and the member/interpretation structure together. Detection, traversal, evidence observation and graph mapping have different completeness denominators. Nested members and competing views can add evidence; a single scalar format should not replace those views.
sis explain format pdf --json
Static format explanations list possible findings and scoring wiring; they do not measure what ran on a particular file.
Related guides
sis docs verdict— coverage, omissions and evidence authoritysis docs asset-graph— nested members and alternate interpretationssis docs extract— text channels and their limitssis docs cdr— selected transforms