"Safe" is relative. The answer depends on what kinds of files you're dealing with and how confident you are that they don't affect Linux.
Binary Files - Easy to determine target platform
Binary files are generally specific to OS and processor architecture, so using a different OS from the one targeted can help reduce the risk of malware infection. For example, if your malware is a PE file (Windows Portable Executable, e.g. .exe, .dll, etc), chances are it won't be able to do much on Linux. Conversely, if your potentially malicious file is an ELF binary (Executable and Linkable Format), it won't be able to do much on Windows.
In this case, since it won't run on the wrong platform, all this practice does is help to reduce the risk that a binary is accidentally run. If you intend to run a potentially malicious binary, you will need to use a compatible platform.
Scripts and Interpreted Code - Harder to determine target platform
Certain scripts can be dangerous across multiple platforms. For example, Python could be used as an initial infection vector to check the OS and establish persistence by downloading corresponding malware.
While these kinds of scripts can be read, some scripts can be heavily obfuscated (these are almost guaranteed to be malicious) or may contain large amounts of code that can make it difficult to identify malicious features.
Documents and Other Files - Very difficult to determine target platform
Malicious Documents will usually target a specific application and either take advantage of legitimate features in an application used to view them (like with Macro Malware for Microsoft Office products) or exploit vulnerabilities in the application used to view them. It may not be as clear what platform or application the malicious document is intended to exploit.
Viewing potentially malicious documents
If your goal is to simply view potentially malicious documents, you can use a non-persistent system which is not networked. That way, it won't matter if it gets infected since you can just reset it.
Keep in mind, removable media could add an element of persistence, so if that's how you're getting the files into the environment you may want to consider keeping copies of the original files and wiping the drive after each use (or use media that has a physical write-protect mechanism, like SD cards).
Detecting malware infections with tool "X"
Be careful about assuming any tool can guarantee a system is or isn't infected. There are many ways to infect a system. The tools you mentioned (rkhunter, chrootkit) would primarily help if the system was infected with a known rootkit ("known" meaning it has been seen before and analyzed). Most other malware detection tools are also based on known signatures / IoCs (Indicators of Compromise). ClamAV may be another tool to consider.
Since your environment is airgapped, you may also want to consider how you intend to update the signature databases for your anti-malware tools.
Dynamic malware analysis techniques may help if you intend to open potentially malicious files and want to know if the system is infected afterwards, though when you're dealing with potential malware it's always best to make sure you don't mind infecting the system.
