diff --git a/superset/charts/api.py b/superset/charts/api.py
index 19a7002e720e8..7e027d66ab5f0 100644
--- a/superset/charts/api.py
+++ b/superset/charts/api.py
@@ -63,7 +63,7 @@
     thumbnail_query_schema,
 )
 from superset.commands.exceptions import CommandInvalidError
-from superset.commands.importers.v1.utils import remove_root
+from superset.commands.importers.v1.utils import is_valid_config, remove_root
 from superset.constants import MODEL_API_RW_METHOD_PERMISSION_MAP, RouteMethod
 from superset.exceptions import SupersetSecurityException
 from superset.extensions import event_logger
@@ -1016,6 +1016,7 @@ def import_(self) -> Response:
             contents = {
                 remove_root(file_name): bundle.read(file_name).decode()
                 for file_name in bundle.namelist()
+                if is_valid_config(file_name)
             }
 
         passwords = (
diff --git a/superset/commands/importers/v1/utils.py b/superset/commands/importers/v1/utils.py
index a94ae18124aa7..a5dd09cd004fa 100644
--- a/superset/commands/importers/v1/utils.py
+++ b/superset/commands/importers/v1/utils.py
@@ -73,3 +73,17 @@ def load_metadata(contents: Dict[str, str]) -> Dict[str, str]:
         raise exc
 
     return metadata
+
+
+def is_valid_config(file_name: str) -> bool:
+    path = Path(file_name)
+
+    # ignore system files that might've been added to the bundle
+    if path.name.startswith(".") or path.name.startswith("_"):
+        return False
+
+    # ensure extension is YAML
+    if path.suffix.lower() not in {".yaml", ".yml"}:
+        return False
+
+    return True
diff --git a/tests/commands_test.py b/tests/commands_test.py
index ee1090355cbfa..08c8d7ae4a0e1 100644
--- a/tests/commands_test.py
+++ b/tests/commands_test.py
@@ -17,6 +17,7 @@
 # pylint: disable=no-self-use
 
 from superset.commands.exceptions import CommandInvalidError
+from superset.commands.importers.v1.utils import is_valid_config
 from tests.base_tests import SupersetTestCase
 
 
@@ -24,3 +25,13 @@ class TestCommandsExceptions(SupersetTestCase):
     def test_command_invalid_error(self):
         exception = CommandInvalidError("A test")
         assert str(exception) == "A test"
+
+
+class TestImportersV1Utils(SupersetTestCase):
+    def test_is_valid_config(self):
+        assert is_valid_config("metadata.yaml")
+        assert is_valid_config("databases/examples.yaml")
+        assert not is_valid_config(".DS_Store")
+        assert not is_valid_config(
+            "__MACOSX/chart_export_20210111T145253/databases/._examples.yaml"
+        )