I would argue that this isn’t a problem with auto mode or the permission system per se. It’s a combination of two issues:

1. Lack of effective sandboxing. Analyzing a zip file should be done in a sandbox specific to that file.

2. Python’s utterly stupid default path behavior. Python should make PYTHONSAFEPATH the default and Claude should have its training or system prompt adjusted to use python -Pc