Malicious Code Hides in Anthropic Skills Test Files

🔑 Enhanced Key Takeaways

• •The vulnerability stems from the 'Anthropic Skills' architecture allowing arbitrary code execution in the host environment because test runners like Jest operate with the same user-level permissions as the developer's IDE or CI/CD pipeline.
• •Gecko Security's research indicates that the attack vector is exacerbated by the 'copy-paste' nature of Skill integration, which bypasses traditional dependency management systems like npm or yarn that would otherwise flag malicious packages.
• •Anthropic has initiated a mandatory security review for all third-party Skills and is reportedly developing a sandboxed execution environment for test files to isolate them from the host filesystem.

🛠️ Technical Deep Dive

• •Vulnerability Mechanism: The exploit leverages the 'beforeAll' hook in Jest/Vitest, which executes before any test cases run, allowing the malicious code to perform filesystem traversal or network requests before the developer realizes a test is running.
• •Attack Surface: The issue is specific to the 'Anthropic Skills' directory structure, where the platform treats .test.ts files as trusted local assets rather than untrusted external inputs.
• •Exfiltration Path: Malicious scripts utilize standard Node.js 'fs' and 'http' modules to exfiltrate environment variables (e.g., ANTHROPIC_API_KEY, AWS_SECRET_ACCESS_KEY) to remote command-and-control (C2) servers.

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline