Office Party: a planted file in /tmp runs code through Anthropic's Office skills on Linux

Researchers at AIR Security have published Office Party, a code execution flaw in Anthropic’s official docx, pptx and xlsx skills, the ones behind Claude’s document features and installable in Claude Code as the document-skills plugin. It affects Linux only. AIR reported it to Anthropic in May; according to AIR, Anthropic acknowledged it but considers it outside its security boundary because the code runs inside a sandbox.

How it works

The three skills share a helper, scripts/office/soffice.py, that runs LibreOffice to convert documents, and the docx skill tells the agent to render every document it writes to PDF through it. LibreOffice needs Unix sockets. When the helper cannot open one, as inside Claude Code’s sandbox, it loads a small shim library into LibreOffice with LD_PRELOAD.

The shim lives at a fixed path, lo_socket_shim.so in the system temp directory. If a file is already there, the helper uses it without checking who wrote it. Whoever puts a library there first gets their code run inside LibreOffice, as the user, on the next document task.

We read the current soffice.py on main on 10 November: it still sets the path from tempfile.gettempdir() and returns the existing file if it exists. The file’s last change was on 17 July.

What AIR showed

AIR reproduced it two ways in Claude Code’s sandbox: by placing the library by hand, and by installing a second, harmless-looking skill that unpacked support files into /tmp, one of them the library. Neither skill does anything a reviewer would flag on its own. AIR says macOS is not affected, because it does not load the library through LD_PRELOAD.

Anything that can write to that temp directory as you can supply the file: another skill, a package install script, an earlier step in a reused container or CI job, or another user on a shared /tmp.

Why this matters

Agent skills compose, so a skill that only unpacks files can arm a trusted one that runs them, which is the same review gap VirusTotal found in malicious skills. Until Anthropic changes the helper, set a private TMPDIR per agent session or user, and do not run document tasks in containers or CI images reused across jobs. A scanner such as NVIDIA’s SkillSpector can review the other skills you install, and our explainer on safe temporary files covers why fixed paths in shared directories are a known trap.