{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0215",
  "aliases": [],
  "published": "2026-09-20T00:00:00Z",
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Broad Claude Code Bash grants let poisoned third-party skills exfiltrate without another prompt.",
  "details": "## What the vulnerability is\n\nA third-party Claude Code skill can turn a broad Bash permission into silent exfiltration. R7 documents a proof of concept in which a modified PowerPoint skill invokes a backup script and uploads presentations after the user has selected allow and do not ask again for Python commands. No second confirmation is needed. R7 also cites a reproducibility audit where skill injection reached up to 100% in a coding harness even though the same weights passed browser tests. This is tool poisoning, not a model jailbreak.\n\n## Which configuration is exposed\n\nThe exposed shape is any Claude Code model with a skills[] entry from outside Anthropic and allowedTools containing Bash(python*) or Bash(*), or an equivalent broad allow rule. The approval condition is acceptEdits, auto, bypassPermissions, or a matching allowlist grant. A reader can recognise it as a repository that installs a community skill, then has Claude Code run Python or shell scripts without another prompt. File read plus network egress turns a poisoned skill into exfiltration.\n\n## How ACVE detects it\n\nThe exact matcher finds a non-Anthropic skill, the broad allowedTools rule, and approval never or allowlist. Because skills are hashed in the lock, a known digest can confirm the supply of the skill; an unpinned or missing skill hash and unknown runtime allow rules make the result possible. ACVE cannot decide what a script does or whether a network was blocked. Runtime permissions and sandbox state must be recorded in safeguards or the lock’s tool attributes.\n\n## Fix\n\n1. Remove wildcard Bash grants from settings:claude-code:allowedTools. 2. Require approval for each Python or shell script until the skill is reviewed. 3. Hash-pin only reviewed skills and reject changes to skills[].sha256. 4. Restrict network egress for presentation, document, and credential directories. 5. Re-run the poisoned-skill fixture with the approval prompt enabled and confirm that upload cannot occur silently.\n\n## Grounding needed\n\nPin the Claude Code version, skill source and SHA-256, allowedTools text, permission mode, script contents, model id, sandbox, and network policy. R7 confidence is M: the skill exfiltration report is a verified proof of concept, while the “up to 100%” coding-harness value comes from a later reproduction audit and is not a full per-model rate. The evidence is therefore enough for a candidate, not a published universal claim.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "any"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://arxiv.org/html/2510.26328"
    },
    {
      "type": "EVIDENCE",
      "url": "https://arxiv.org/html/2606.05233"
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "tool-poisoning"
      ],
      "cwe": [
        "CWE-74"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI04"
        ]
      },
      "noCveReason": "behavioural — no code defect; evidence is an evaluation",
      "threat": {
        "attacker": "tool-provider",
        "vector": "tool-poisoning",
        "outcome": "exfiltration"
      },
      "evidence": [
        {
          "kind": "incident",
          "benchmark": "Agent Skills exfiltration proof of concept",
          "benchmarkVersion": "2025",
          "attack": "poisoned skill invokes a backup script after an allow-and-do-not-ask grant",
          "defense": "none",
          "metric": "asr",
          "model": {
            "id": "Claude Code model unspecified",
            "quant": null
          },
          "setup": {
            "tools": [
              "Python",
              "file read",
              "external upload"
            ],
            "approval": "allowlist",
            "defences": []
          },
          "url": "https://arxiv.org/html/2510.26328",
          "note": "PoC only; no rate"
        },
        {
          "kind": "eval",
          "benchmark": "CUA-HandCrafted skill-injection comparison",
          "benchmarkVersion": "2026",
          "attack": "skill injection",
          "defense": "none",
          "metric": "asr",
          "value": 1,
          "model": {
            "id": "model unspecified",
            "quant": null
          },
          "setup": {
            "tools": [
              "coding harness"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/abs/2606.05233",
          "note": "comparison; up to 100%; skill-injection result"
        }
      ],
      "matcher": {
        "all": [
          {
            "all": [
              {
                "some": "skills",
                "where": {
                  "field": "name",
                  "op": "regex",
                  "value": "^(?!anthropic$).+"
                }
              },
              {
                "field": "allowedTools",
                "op": "contains",
                "value": "Bash(*)"
              }
            ]
          },
          {
            "field": "approval",
            "op": "in",
            "value": [
              "never",
              "allowlist"
            ]
          }
        ]
      },
      "fix": {
        "summary": "Remove wildcard Bash grants, require script approval, and hash-pin third-party skills.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "settings:claude-code:allowedTools",
            "to": "remove Bash(*) and Bash(python*)",
            "why": "A broad allow rule is the approval bypass used by the poisoned skill path."
          },
          {
            "type": "reconfigure",
            "target": "agent.approval",
            "to": "ask",
            "why": "A human must approve each script until the skill and its network behavior are reviewed."
          },
          {
            "type": "reconfigure",
            "target": "skills:sha256",
            "to": "approved hashes only",
            "why": "The lock already records skill hashes; reject a changed third-party skill as a new artifact."
          }
        ]
      }
    }
  }
}