Office Party Shows Why AI Skills Need Filesystem Trust Boundaries
New research into document skills shows how shared temporary files can turn an ordinary conversion task into unintended code execution.
AIR Security’s November 5 Office Party report describes a flaw in Anthropic’s DOCX, PPTX, and XLSX skills on Linux. A document-conversion helper loads a library from a predictable temporary path when Unix socket creation fails. According to the researchers, it reuses an existing file without verifying its origin, allowing a planted library to execute with the agent user’s privileges.
AIR reports reproducing execution both by placing the library directly and through another skill that deposited it earlier. This requires write access to the relevant temporary directory and the socket-failure condition; it is not evidence that opening any document compromises a machine. AIR says Anthropic acknowledged the report but regarded it as outside its security boundary because execution stays inside a sandbox. The publication does not establish a sandbox escape or in-the-wild exploitation. Its statement that the helper remained unchanged is dated November 5, not a verified patch-status claim for today.
MITRE’s CWE-377 describes the broader, longstanding risk of insecure temporary files: predictable names and unsafe creation or reuse can allow another process to substitute content or interfere with application data. This reference explains the weakness class; it does not independently corroborate AIR’s findings. For agent deployments, the operational implication is that a shared working environment can connect two otherwise separate tasks through files left behind.
Our recommendation is to review document-conversion helpers alongside skill instructions. Identify where executable libraries and scripts are loaded, who can write those locations, and whether one job can influence the next. Prefer private temporary directories with restrictive permissions, secure atomic file creation, and explicit verification of executable dependencies. A trusted publisher is useful provenance, but each helper still needs conventional software-security review.
This week, test one representative document workflow in an isolated environment with synthetic data. Check that unexpected pre-existing artifacts are rejected and that cleanup prevents reuse across trust boundaries. Record the exact skill revision and runtime configuration so the result is reproducible. Keep the sandbox’s reachable files, credentials, and network destinations minimal: even code execution contained within it can matter if that environment holds sensitive access.
Source notes
Follow these links to check the reporting and documentation behind this article.