ACVE-2026-0215

The configuration

Configuration label

approval never|allowlist

Affected entries

• AgentHarness: any — ECOSYSTEM (introduced 0)

Matcher

• all
  • all
    • some skills
      • name regex "^(?!anthropic$).+"
    • allowedTools contains "Bash(*)"
  • approval in [ "never", "allowlist" ]

Threat

Attacker

tool-provider

Vector

tool-poisoning

Outcome

exfiltration

Evidence

Why it is exploitable

What the vulnerability is

A third-party Claude Code skill can turn a broad Bash permission into silent exfiltration. R7 documents a proof of concept in which a modified PowerPoint skill invokes a backup script and uploads presentations after the user has selected allow and do not ask again for Python commands. No second confirmation is needed. R7 also cites a reproducibility audit where skill injection reached up to 100% in a coding harness even though the same weights passed browser tests. This is tool poisoning, not a model jailbreak.

Which configuration is exposed

The exposed shape is any Claude Code model with a skills[] entry from outside Anthropic and allowedTools containing Bash(python) or Bash(), or an equivalent broad allow rule. The approval condition is acceptEdits, auto, bypassPermissions, or a matching allowlist grant. A reader can recognise it as a repository that installs a community skill, then has Claude Code run Python or shell scripts without another prompt. File read plus network egress turns a poisoned skill into exfiltration.

How ACVE detects it

The exact matcher finds a non-Anthropic skill, the broad allowedTools rule, and approval never or allowlist. Because skills are hashed in the lock, a known digest can confirm the supply of the skill; an unpinned or missing skill hash and unknown runtime allow rules make the result possible. ACVE cannot decide what a script does or whether a network was blocked. Runtime permissions and sandbox state must be recorded in safeguards or the lock’s tool attributes.

Fix

1. Remove wildcard Bash grants from settings:claude-code:allowedTools. 2. Require approval for each Python or shell script until the skill is reviewed. 3. Hash-pin only reviewed skills and reject changes to skills[].sha256. 4. Restrict network egress for presentation, document, and credential directories. 5. Re-run the poisoned-skill fixture with the approval prompt enabled and confirm that upload cannot occur silently.

Grounding needed

Pin the Claude Code version, skill source and SHA-256, allowedTools text, permission mode, script contents, model id, sandbox, and network policy. R7 confidence is M: the skill exfiltration report is a verified proof of concept, while the “up to 100%” coding-harness value comes from a later reproduction audit and is not a full per-model rate. The evidence is therefore enough for a candidate, not a published universal claim.

Underlying CVEs / aliases

No CVE assigned. behavioural — no code defect; evidence is an evaluation

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Remove wildcard Bash grants, require script approval, and hash-pin third-party skills.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

EVIDENCE

• https://arxiv.org/html/2510.26328
• https://arxiv.org/html/2606.05233