One Planted File in /tmp: AIR’s “Office Party” Turns Anthropic’s Official Office Skills Into Code Execution on Linux

2026-11-09 Agent & Supply Chain Security by al-ice.ai Editorial

On 5 November 2026, Air Security published “Office Party”: a code-execution vulnerability in Anthropic’s official docx, pptx and xlsx skills — the same skills behind Claude’s own document features on claude.ai, published in Anthropic’s official anthropics/skills repository and installable by Claude Code users as document-skills. To convert documents, the skills run LibreOffice through a helper script, scripts/office/soffice.py. When Unix-domain sockets cannot be opened — the normal case inside Claude Code’s sandbox — the helper loads a small “shim” library into LibreOffice via LD_PRELOAD. The shim always lives at the same fixed path in the shared temporary directory, lo_socket_shim.so, and if a file is already there, it gets used, with no check of who wrote it or what it contains. Whoever writes it first wins — and their code runs inside LibreOffice, as the user, before a single page is converted.

Three design choices that combine into a vulnerability

Air’s write-up isolates the mechanism precisely: a fixed path (the shim is always lo_socket_shim.so in the shared temp directory), no checks (an existing file is loaded without verifying origin or contents), and a hair trigger — any failure to open a socket flips the shim on, not just a sandbox block. Running out of file descriptors would do it. LD_PRELOAD loads a library into a program before it starts, and the library’s code runs automatically. And this is not a rarely used corner of the skill: the docx skill instructs the agent to render every document it writes to PDF through this helper to check how it looks, and the same helper ships unchanged in the pptx and xlsx skills. The attacker needs exactly one thing — a file named lo_socket_shim.so sitting in the temp directory before Claude’s next document task — placeable by anything running with the user’s privileges that can write there: another skill, a package’s install script, an earlier step in a reused container or CI job, or another user where /tmp is shared.

Two reproductions, including one with no planting at all

Air reproduced it two ways. The direct route: install Anthropic’s official document-skills plugin, place a library at that path in Claude Code’s sandbox temp directory, ask Claude for a document — the library loads and runs. The second route needed no planting of their own. They let another skill do it — an ordinary-looking skill that writes marketing copy and, along the way, unpacks supporting files into /tmp, one of which is the library. Neither skill does anything a reviewer would flag, and together they run the attacker’s code without either one stepping out of line. That compositional property is the enterprise sting: as Air’s Niv Hoffman told Dark Reading, companies often lack visibility into which skills and agent add-ons they have installed, and a malicious or compromised skill need not touch the document pipeline at all — it merely has to place a file that a trusted component will execute. macOS is not affected, because it does not load the library through LD_PRELOAD.

The window was flagged in June — then walked through in November

This is the rare vulnerability with a dated prediction on record. Trail of Bits’ 3 June 2026 write-up on skill distribution had already called out this exact helper — an official Anthropic skill script that LD_PRELOADs an arbitrary binary from $TMP/lo_socket_shim.so — noting it was “hard to imagine a more suspicious thing a skill could possibly do,” that scanners rated it LOW to MEDIUM on the strength of the skill’s own embedded explanation, and that it created a window for arbitrary code execution if an adversary could sneak a malicious file into the temp path. Office Party is that window, walked through five months later. It also continues Air’s own official-skills thread: in OpenAI Sesame the lab showed an official skill could compromise real infrastructure on its own; here the vulnerable skill is Anthropic’s, and the flaw is a classic — a trusted program that runs whatever file it finds in a shared folder.

Acknowledged in May, still shipping in November

Air found the flaw in May 2026 and reported it to Anthropic, which acknowledged it but considers it outside its security boundary, since the vulnerable code only runs inside a sandbox. As of 5 November 2026, Air reports, soffice.py on main in anthropics/skills still uses the same fixed path and still loads whatever file it finds there. We checked the current tree ourselves: skills/docx/scripts/office/soffice.py on main still defines _SHIM_SO = Path(tempfile.gettempdir()) / "lo_socket_shim.so" and loads it on exists() — the trust is still unconditional today. Dark Reading’s 9 November coverage quotes Hoffman’s summary of the exposure: one planted file in a shared temporary folder, and the next document request makes Anthropic’s trusted skill run the attacker’s code with the employee’s own access, through default skills installed across the agent fleet. The sandbox-boundary framing deserves scrutiny from defenders: the code that loads the planted library may execute inside a sandbox, but the user whose privileges the library inherits is the enterprise employee — and the second reproduction shows the planter need not be sandboxed at all.

What to actually do

Treat official skills as untrusted code with a trusted brand: inventory every skill installed across agents — including vendor-published ones — and subject their helper scripts to the same review you would give any dependency that shells out with your users’ privileges.
Hunt for skill-composition pairs, not just malicious skills: an installer or dropper skill that only writes files to shared temp directories is the other half of this attack, and it will sail through single-skill review.
Harden shared temporary directories on agent hosts: per-job TMPDIR isolation, no shared /tmp across trust boundaries, and monitoring for unexpected .so writes — the Apiiro settings.local.json exposure already showed how much agent-adjacent state sits in predictable paths.
Watch the upstream fix state rather than assuming one: as long as soffice.py trusts the fixed path, every document-conversion request in a socket-blocked environment is a load-what-you-find event.

Our verification was read-only. We read the Air Security “Office Party” report first-hand (published 5 November 2026, authors Omri Saxena and Or Nevo) including its mechanism description, quoted helper logic, both reproduction accounts, and the disclosure timeline and Anthropic-response statements. Independently, via raw fetches, we confirmed skills/docx/scripts/office/soffice.py on anthropics/skills main still defines the fixed lo_socket_shim.so temp path and loads it on exists() with LD_PRELOAD. We read the Trail of Bits 3 June 2026 skill-distribution write-up first-hand for its soffice.py discussion and scanner-rating account. The Dark Reading 9 November 2026 coverage (Elizabeth Montalbano) and its Niv Hoffman quotes are carried as reported; the macOS non-impact and sandbox-affected-environments details come from that secondary. We planted no files, ran no skills, executed no LibreOffice conversion, and contacted no vendor. Brave Search was used for discovery only.

Sources: