Selected SCORM Package Launch Audit

How to use Selected SCORM Package Launch Audit

Review a package’s static launch declarations before opening it in an LMS. The report connects original item IDs to declared resources, checks package directory paths and missing dependencies and exposes unreferenced files. Only the root manifest is extracted; learning HTML, scripts and media remain unopened.

1. Choose a small supported SCORM 2004 ZIP or load the generated original package.
2. Inspect item/resource links, missing launch/files/dependencies, declared cycles and unreferenced directory entries.
3. Keep the evidence separate from a real LMS compatibility or security review; no course content is opened here.

Good to know

• One strict stored/DEFLATE ZIP of at most 4 MiB and 200 safe entries. Existing directory/local-header, traversal, overlap, encryption, symlink, ZIP64 and expansion bounds apply. One root imsmanifest.xml is limited to 200,000 uncompressed UTF-8 bytes before extraction, then actual size and CRC are verified.
• Native XML only, with DTD/entity refusal, at most 10,000 elements, 20 organizations, 200 resources, 200 organization items, 20 item levels and 1,000 file/dependency declarations. Requires the IMS namespace, ADL SCORM/2004 metadata, hierarchical organization source and webcontent resources with explicit sco/asset kind. Selected IDs are unique bounded ASCII names; references use the same name grammar.
• xml:base, nested manifests, remote/absolute paths, traversal and encoded separators are refused. Relative filenames are percent-decoded once for ZIP lookup; query/fragment suffixes remain source data. Item parameters are retained without computing effective launch behavior. Unknown metadata and extensions are unassessed.
• This is not XSD, SCORM edition, runtime, sequencing, navigation, scoring, accessibility, LMS import, malware or package conformance certification. Only manifest CRC is checked; other entries stay untrusted metadata. No HTML, script, XSD or linked resource is fetched, rendered or executed. Real native XML/file gates are required before release.
• Processing is local. Output is limited to 1,000,000 text characters unless a stricter file limit is stated.