open/llm-security
1
0
Fork 0
Code Issues Releases 6 Activity

test(llm-security): store the poisoned-claude-md fixture encoded

Browse source 
v8.1.0 S2. examples/poisoned-claude-md/fixture/ (CLAUDE.md with a base64
pipe-to-shell blob, plus an agent file) is now fixture.archive.json in the
same format as the demo archive; run-memory-poisoning.mjs materializes it
into a temp dir and deletes it on exit. README shows materialize-then-scan.
payload-trees.test.mjs asserts byte identity for both archives.

av-surface: b 6->5, d 1->0. Walkthrough output identical before/after
(6 pass, 0 fail, 18 findings).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-09-22 13:22:10 +02:00
commit 7d1de2ce25
Signed by: ktg
SSH key fingerprint: SHA256:JakMjO6FTBBzN0Bhfj9saOoEjaFxlSdYuZQQpM/lF9Q
6 changed files with 117 additions and 74 deletions
Download patch file Download diff file Expand all files Collapse all files

3
tests/helpers/payload-trees.test.mjs
View file

@ -5,7 +5,7 @@
import { describe, it } from 'node:test';
import assert from 'node:assert/strict';
import { readFileSync, readdirSync } from 'node:fs';
import { join, relative, basename } from 'node:path';
import { join, relative, basename, dirname, resolve } from 'node:path';
import { createHash } from 'node:crypto';
import { PAYLOAD_TREES, materializeTree } from './payload-trees.mjs';
import { DEMO_ARCHIVE, readArchive, materializeArchive } from '../../examples/malicious-skill-demo/materialize.mjs';
@ -38,6 +38,7 @@ describe('payload-trees: materialized bytes match the retired on-disk fixtures',
// examples; same check, sha256 measured from the retired on-disk files.
const EXAMPLE_ARCHIVES = {
'malicious-skill-demo/evil-project-health': DEMO_ARCHIVE,
'poisoned-claude-md/fixture': resolve(dirname(DEMO_ARCHIVE), '../poisoned-claude-md/fixture.archive.json'),
};
describe('example archives: materialized bytes match the retired on-disk trees', () => {