Anthropic SDK Attack Probe

Authorized self-test for apps using the Anthropic SDK. Follow shared probing conventions — discover endpoint via env or app/api/chat, FastAPI route, etc. Pair with the general prompt-injection-probe for the cross-vendor payload battery; this skill adds Claude/Anthropic-specific probes.

Anthropic-specific attack surface

• XML tag framing is the canonical pattern Anthropic recommends — and so attackers craft payloads that also speak XML to get the model to flip frames (</document><system>...</system>).
• Assistant prefill (messages: [{role:"user",...}, {role:"assistant", content:"Sure! "}]) is powerful but apps often expose the prefill string as configurable, letting users bypass refusals.
• Tool input_schema is JSON Schema — but the SDK does not enforce it server-side; the developer must validate in their tool handler.
• Prompt caching breakpoints in system/messages blocks: if a developer caches per-user data, an attacker who can influence the cached prefix may observe cross-conversation leakage.
• Vision content blocks can include inline images with embedded text — instructions inside images bypass text-only filters.

Required setup

User provides:

1. Endpoint accepting Claude-style chat requests.
2. Canary token in the system prompt (e.g., CANARY_AKL_42).
3. (Optional) Tool definitions list.
4. (Optional) Whether prompt caching is enabled.