open/llm-security
1
0
Fork 0
Code Issues Releases 6 Activity

test(llm-security): store the poisoned-claude-md fixture encoded

Browse source 
v8.1.0 S2. examples/poisoned-claude-md/fixture/ (CLAUDE.md with a base64
pipe-to-shell blob, plus an agent file) is now fixture.archive.json in the
same format as the demo archive; run-memory-poisoning.mjs materializes it
into a temp dir and deletes it on exit. README shows materialize-then-scan.
payload-trees.test.mjs asserts byte identity for both archives.

av-surface: b 6->5, d 1->0. Walkthrough output identical before/after
(6 pass, 0 fail, 18 findings).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-09-22 13:22:10 +02:00
commit 7d1de2ce25
Signed by: ktg
SSH key fingerprint: SHA256:JakMjO6FTBBzN0Bhfj9saOoEjaFxlSdYuZQQpM/lF9Q
6 changed files with 117 additions and 74 deletions
Download patch file Download diff file Expand all files Collapse all files

14
examples/poisoned-claude-md/README.md
View file

@ -29,6 +29,11 @@ The fixture also covers v7.2.0's E15 surface — agent files
(`.claude/agents/*.md`) — by planting matching signals in
`fixture/.claude/agents/health-checker.md`.
The fixture is not stored in the repository as files: antivirus products
(Windows Defender among them) quarantine a poisoned `CLAUDE.md` on clone.
It lives encoded in `fixture.archive.json` (rot13 text, non-ASCII characters
as codepoint numbers) and is written to a temp directory when you need it.
## How to run
```bash
@ -39,6 +44,15 @@ node examples/poisoned-claude-md/run-memory-poisoning.mjs
node examples/poisoned-claude-md/run-memory-poisoning.mjs --verbose
```
The walkthrough materializes the fixture itself and deletes it on exit. To
scan it with anything else, materialize first, then scan the printed path:
```bash
FIX="$(node examples/malicious-skill-demo/materialize.mjs examples/poisoned-claude-md/fixture.archive.json)"
node scanners/scan-orchestrator.mjs "$FIX"
rm -rf "$(dirname "$FIX")" # when you are done
```
Expected: `6 pass, 0 fail` and `18` total findings (or more, as
detectors evolve).