Detect com.apple.quarantine bit

Content Authoring
1

We've run into a situation where the com.apple.quarantine bit needs to be removed from some files in our environment, with xattr -d com.apple.quarantine "/path/to/file".

I'd like to detect the problem files with relevance, but I'm not sure how. The security descriptors property is only available on Windows, and I haven't been able to get anywhere with inspecting the bytes of the file.

For example, my file has the quarantine bit:

Downloads % ls -al@ "myFile"
-rw-r--r--@ 1 user  staff  238 Sep 15 11:11 myFile
	com.apple.metadata:kMDItemWhereFroms	257 
	com.apple.quarantine	 58

I look at the bytes:

Q: concatenations of lasts 2 of ("0" & it) of (bytes (integers in (0,500)) of file "/path/to/myFile" as hexadecimal)
A: 4964656e7469747920547970652c557365726e616d652c446f6d61696e2c456d61696c2c4669727374204e616d652c4c617374204e616d652c557365722047726f7570732c436f756e74727920436f64650d0a4665646572617465642049442c6162633132332c6e79752e6564752c616263313233406e79752e6564752c4a6f686e2c536d6974682c4e5955204465706172746d656e7420412c55530d0a4665646572617465642049442c6465663435362c6e79752e6564752c646566343536406e79752e6564752c4a616e652c446f652c4e5955204465706172746d656e7420412c55530d0a2c2c2c2c2c2c2c
T: 13774
I: string

I remove the bit:

Downloads % xattr -d com.apple.quarantine "myFile"
Downloads % ls -al@ "myFile"
-rw-r--r--@ 1 user  staff  238 Sep 15 11:04 myFile
	com.apple.metadata:kMDItemWhereFroms	257

And the bytes stay the same:

Q: concatenations of lasts 2 of ("0" & it) of (bytes (integers in (0,500)) of file "/path/to/myFile" as hexadecimal)
A: 4964656e7469747920547970652c557365726e616d652c446f6d61696e2c456d61696c2c4669727374204e616d652c4c617374204e616d652c557365722047726f7570732c436f756e74727920436f64650d0a4665646572617465642049442c6162633132332c6e79752e6564752c616263313233406e79752e6564752c4a6f686e2c536d6974682c4e5955204465706172746d656e7420412c55530d0a4665646572617465642049442c6465663435362c6e79752e6564752c646566343536406e79752e6564752c4a616e652c446f652c4e5955204465706172746d656e7420412c55530d0a2c2c2c2c2c2c2c
T: 18728
I: string

Is there anything else I can try, purely with Relevance? I know I can deploy another action to check the file and trigger a follow up action to remediate.