anthropic-sdk-attack-probe

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). This skill explicitly instructs the agent to provoke and detect leakage of a "canary" token and other sensitive contents (e.g., /etc/passwd or tool outputs) from a target and to report when the secret appears, which requires the LLM to handle and potentially output secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document contains explicit, actionable probe payloads and code patterns that enable data exfiltration (canary/system-prompt leakage), credential exposure, and backdoor-style remote actions via tool misuse (file reads like /etc/passwd, inducing rm -rf), plus role‑play/image/obfuscation techniques to bypass guards — high-risk if repurposed or executed against real targets.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The required workflow is an Anthropic SDK “attack probe” that sends attacker-crafted free-text payloads (e.g., XML tag confusion, prefill abuse, tool-injection prompts, image-instruction text) into the agent’s LLM context via the app’s chat request body, so the LLM ingests outsider-authored prompt text at runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill contains explicit probes that ask the model to invoke tools to read sensitive system files (e.g., /etc/passwd) and attempt destructive commands (e.g., "rm -rf /"), which directly encourage modifying or exposing the host machine's state.