AI and security briefsSecurity

Can a planted /tmp file run code through Claude's document skills on Linux, and is it fixed?

By Brandon Da Costa, founder of Digiton Dynamics

Published 9 November 2026Updated 9 November 2026Editorial policy

Dark Reading's 9 November 2026 headline says a Claude flaw threatens Linux organisations with malicious code execution. The code is public: Anthropic's docx, pptx and xlsx skills load a helper library from a fixed path in the shared temp directory, so a file planted there runs as the user. I found no CVE and no fix.

Who should act: Anyone running Anthropic's document skills on Linux hosts, containers or CI runners where other users or untrusted code can write to the shared temp directory.

What happened

Dark Reading ran the story on 9 November under the headline "Claude Flaw Threatens Linux Orgs with Malicious Code Execution". Its page blocks automated readers, so this brief does not repeat the article's details. It works from the code, which is public, and from the people who reported the same weakness in the open.

The code is public. In Anthropic's skills repository, docx, pptx and xlsx each ship the same scripts/office/soffice.py, with identical checksums when I fetched them on 9 November. It helps LibreOffice run where AF_UNIX sockets are blocked. When opening such a socket fails, it points LD_PRELOAD at a shim library at a fixed path built from the temp directory, /tmp/lo_socket_shim.so on a default Linux box. If that file exists, the script returns it as is. Otherwise it compiles one with gcc.

An independent contributor described the same weakness in a pull request on 26 September (anthropics/skills, number 1874) and proposed a private temporary directory. It is still open, unmerged. The contributor says it matters on multi-user hosts such as shared CI runners and shared development boxes. Trail of Bits had already flagged the LD_PRELOAD shim in June as an example of why skill scanners struggle. I searched the NVD today and found no CVE.

Who is affected

• Linux machines, containers and CI runners where the document skills run and sockets are blocked, the condition that triggers the shim. Claude Code's sandbox docs say its optional seccomp filter adds Unix domain socket blocking, so this includes sandboxed setups.
• Shared hosts, where another local user or a job running untrusted code could create /tmp/lo_socket_shim.so first.
• Not macOS, per a GitHub issue on the Sage scanner, because LD_PRELOAD is not used there.
• A single-user laptop with a private /tmp has a much smaller exposure, since the attacker needs a way to write that file.

What we checked

Run on 9 November 2026 on the Mac that builds this site. Each command and its output are copied as they ran.

$ curl -s https://raw.githubusercontent.com/anthropics/skills/main/skills/pptx/scripts/office/soffice.py | grep -n '_SHIM_SO ='
50:_SHIM_SO = Path(tempfile.gettempdir()) / "lo_socket_shim.so"

$ printf '%s\n' docx pptx xlsx | xargs -I{} sh -c "curl -s https://raw.githubusercontent.com/anthropics/skills/main/skills/{}/scripts/office/soffice.py | shasum | cut -c1-12"
623cfa7c71b7
623cfa7c71b7
623cfa7c71b7

The shim path is a fixed name in the temp directory, and the three skills ship the same file.

What to do now

1. Look for the shim and for the skills that carry the script.

   ls -l /tmp/lo_socket_shim.so /tmp/lo_socket_shim.c
   stat -c '%U %y %n' /tmp/lo_socket_shim.so
   grep -rl lo_socket_shim ~/.claude 2>/dev/null

2. Delete a shim you did not build yourself. If the owner is another user, treat the host as suspect and review that user's activity.
3. Give the skills a private temp directory, because Python's temp lookup follows TMPDIR.

   export TMPDIR="$(mktemp -d)"
   chmod 700 "$TMPDIR"

4. Prefer the sandbox. Anthropic's docs say that unless filesystem isolation is off, Claude Code sets TMPDIR to a per-user directory for sandboxed commands. Setup is in the Claude Code sandbox guide, and the rule syntax is on the permissions page.
5. On shared runners, keep untrusted jobs away from the document skills, or copy the skill and apply the private-directory change from pull request 1874 after reading it.
6. Watch the pull request and the skills repository for a merged fix, then update your copy. Wider context is in is Claude Code safe.

What should have been in place

• Helper scripts that write to a private directory created with mode 0700, never a fixed name in the shared temp folder.
• A check that a library is owned by the current user before it is loaded.
• Skills treated as code, pinned to a reviewed copy that your team controls.
• A disclosure path that tells users when a reported flaw is accepted but left open, so they can contain it themselves.

Questions people ask

Digiton's production review covers which skills, plugins and instruction files your agents load and where they write, and the checks it runs are on the Claude Code governance page.

How this brief was made: researched from the sources below, drafted with AI assistance and checked against each source on the dates shown. See the editorial policy.

Sources

1. Anthropic skills repository, soffice.py in the pptx skill, read 9 November 2026. https://github.com/anthropics/skills/blob/main/skills/pptx/scripts/office/soffice.py
2. Anthropic skills repository, pull request 1874 on private temp directories, 26 September 2026, read 9 November 2026. https://github.com/anthropics/skills/pull/1874
3. Trail of Bits, the state of skill distribution, 3 June 2026, read 9 November 2026. https://blog.trailofbits.com/2026/06/03/the-sorry-state-of-skill-distribution/
4. Sage scanner issue 52, pptx skill LD_PRELOAD report, 26 October 2026, read 9 November 2026. https://github.com/gendigitalinc/sage/issues/52
5. Claude Code docs, sandboxing, read 9 November 2026. https://code.claude.com/docs/en/sandboxing

More briefs

How these briefs are sourced and corrected. All AI and security briefs