title: Credential Exfiltration via Shell Pipe
id: ATR-2026-00201
status: experimental
description: |
  Detects credential theft patterns where environment variables containing API keys, secrets, or tokens are piped to external commands (curl, nc, etc.) or echoed for capture. Also detects explicit references to provider-specific API key variable names (ANTHROPIC_*, OPENAI_*, AWS_*, etc.) which may indicate reconnaissance or targeting. Derived from real-world Claude Code skill scanning.
author: TYSYS (Wind) — skill-sanitizer project
date: 2026/04/05
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM02:2025
    - LLM06:2025
  owasp_agentic:
    - ASI02:2026
    - ASI03:2026
  mitre_atlas:
    - AML.T0055 - Unsecured Credentials
    - AML.T0086 - Exfiltration via AI Agent Tool Invocation
  mitre_attack:
    - T1552.001 - Credentials In Files
    - T1041 - Exfiltration Over C2 Channel
compliance:
  nist_ai_rmf:
    - subcategory: MS.2.10
      context: The rule detects exfiltration of credentials and API keys through shell pipes to external commands, which is a direct privacy and confidentiality risk; MS.2.10 requires assessing privacy risks including unauthorized disclosure of sensitive secrets handled by AI agents.
      strength: primary
    - subcategory: MS.2.7
      context: Piping environment variables containing API keys to curl or netcat represents a security/resilience failure where the agent's execution environment is being abused for data exfiltration; MS.2.7 requires continuous evaluation of these security control failures.
      strength: secondary
    - subcategory: MG.2.3
      context: Detection of credential exfiltration patterns must trigger immediate containment to disengage the agent before secrets reach attacker-controlled endpoints; MG.2.3 mandates pre-defined mechanisms to supersede or deactivate the AI system on such high-severity events.
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Credential Exfiltration via Shell Pipe).
      strength: primary
    - clause: '6.2'
      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Credential Exfiltration via Shell Pipe) is such a treatment.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Credential Exfiltration via Shell Pipe).
      strength: primary
    - article: '10'
      context: Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Credential Exfiltration via Shell Pipe) affecting that data.
      strength: secondary
tags:
  category: context-exfiltration
  subcategory: credential-pipe
  confidence: high
agent_source:
  type: llm_io
  framework:
    - mcp
    - claude-code
    - langchain
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: (?i)echo\s+\$\{?[A-Z_]*(API_KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL)[A-Z_]*\}?\s*\|
      description: Echo sensitive env var piped to another command
    - field: content
      operator: regex
      value: (?i)(cat|printenv|env|set)\s+.{0,20}(API_KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL)\s*\|
      description: Read sensitive var piped to external command
    - field: content
      operator: regex
      value: (?i)curl\s+.{0,100}(-d|--data)\s+.{0,30}(key|token|secret|password|credential)
      description: Curl POST with credential data
  condition: any
  false_positives:
    - Setup documentation explaining how to configure API keys
    - Debugging guides that show how to verify key configuration
response:
  actions:
    - block_tool
    - alert
  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): benign FP 4/5352 = 0.07% meets the 0.5% ceiling but is not zero; ceiling = degrade. Removed quarantine_session(terminate). Detection unchanged — recall cost is zero.'
  auto_response_threshold: high
  message_template: '[ATR-2026-00201] Credential exfiltration attempt detected — {matched_pattern}'