open/llm-security
1
0
Fork 0
Code Issues Releases 6 Activity

test(llm-security): store the poisoned-claude-md fixture encoded

Browse source 
v8.1.0 S2. examples/poisoned-claude-md/fixture/ (CLAUDE.md with a base64
pipe-to-shell blob, plus an agent file) is now fixture.archive.json in the
same format as the demo archive; run-memory-poisoning.mjs materializes it
into a temp dir and deletes it on exit. README shows materialize-then-scan.
payload-trees.test.mjs asserts byte identity for both archives.

av-surface: b 6->5, d 1->0. Walkthrough output identical before/after
(6 pass, 0 fail, 18 findings).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-09-22 13:22:10 +02:00
commit 7d1de2ce25
Signed by: ktg
SSH key fingerprint: SHA256:JakMjO6FTBBzN0Bhfj9saOoEjaFxlSdYuZQQpM/lF9Q
6 changed files with 117 additions and 74 deletions
Download patch file Download diff file Expand all files Collapse all files

10
examples/poisoned-claude-md/run-memory-poisoning.mjs
View file

@ -1,7 +1,8 @@
#!/usr/bin/env node
// run-memory-poisoning.mjs — Memory-poisoning scanner walkthrough
// Runs scanners/memory-poisoning-scanner.mjs against a deliberately
// poisoned CLAUDE.md + .claude/agents/health-checker.md fixture and
// poisoned CLAUDE.md + .claude/agents/health-checker.md fixture
// (materialized from fixture.archive.json into a temp dir) and
// verifies all six detector categories report at least one finding.
//
// Categories (per memory-poisoning-scanner.mjs):
@ -22,7 +23,12 @@ import { fileURLToPath } from 'node:url';
const __dirname = dirname(fileURLToPath(import.meta.url));
const PLUGIN_ROOT = resolve(__dirname, '../..');
const FIXTURE = resolve(__dirname, 'fixture');
// v8.1.0 (S2): the poisoned fixture is not stored on disk as files — antivirus
// products quarantine it. It lives encoded in fixture.archive.json and is
// written to a temp dir for this run, then deleted on exit.
const { materializeArchive } = await import(resolve(__dirname, '../malicious-skill-demo/materialize.mjs'));
const { dir: FIXTURE, cleanup } = materializeArchive(resolve(__dirname, 'fixture.archive.json'));
process.on('exit', cleanup);
const VERBOSE = process.argv.includes('--verbose');
// ---------------------------------------------------------------------------