Claude 'Office Party' Skills Flaw Runs Code on Linux

Where the flaw is

Claude's official DOCX, PPTX and XLSX skills rely on a helper, soffice.py, which starts LibreOffice for conversions such as Word to PDF. When it cannot open Unix-domain sockets, it falls back to loading a shared library through Linux LD_PRELOAD.

The script looks for lo_socket_shim.so in a shared temp directory without checking its origin or contents. Anyone who places a malicious library there before the next conversion gets code running inside LibreOffice with the privileges of the user running the agent.

Who is affected

Linux environments where Unix sockets are blocked, including some container security setups and the Claude Code sandbox. macOS is safe here, since it never uses LD_PRELOAD for this library.

Researchers showed two scenarios: planting the library manually, or using a separate, harmless-looking skill to unpack a file into the same folder. The second shows how benign skills can combine into an attack chain.

Anthropic's position

AIR reported the flaw in May. Anthropic acknowledged it but considers it outside its security boundary because the code runs in a sandbox. The researchers counter that the attacker's code then runs inside that sandbox with the user's own permissions and files.

What to do

1. Maintain an up-to-date list of all AI skills and add-ons your teams use.
2. Treat skills, even official ones, like any dependency: review and update them.
3. On shared Linux hosts, watch temp folders for unexpected .so files.