title: Natural-Language Unauthorized Shell-Execution Instruction
id: ATR-2026-00428
rule_version: 1
status: experimental
description: |
  Detects natural-language imperative instructions that direct the agent to
  silently execute shell commands or arbitrary scripts without user consent.
  Discriminator: imperative execution verb + shell-command target +
  silent / no-confirmation framing. Catches the framing layer before any
  specific payload (e.g. curl|sh, base64-encoded), so it triggers even on
  novel commands the agent's specific block-list doesn't cover.
author: ATR Community
date: 2026/05/06
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  mitre_atlas:
    - AML.T0044 - Full AI Model Access
  owasp_llm:
    - LLM06:2025
  owasp_agentic:
    - ASI06:2026
    - ASI04:2026
compliance:
  eu_ai_act:
    - article: '15'
      context: Article 15 cybersecurity controls require detection of NL-style instructions that direct the agent to execute arbitrary shell commands without user authorization.
      strength: primary
    - article: '14'
      context: Article 14 human oversight requires the user to authorize tool execution; covert shell-execution instructions bypass this control.
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the unsafe autonomous action (Natural-Language Unauthorized Shell-Execution Instruction).
      strength: secondary
  nist_ai_rmf:
    - subcategory: GV.6.1
      context: Data governance must prevent NL instructions that authorize the agent to bypass user consent for command execution.
      strength: primary
    - subcategory: MS.2.5
      context: Monitoring under MS.2.5 must detect NL-style covert-shell-execution patterns.
      strength: primary
    - subcategory: MG.2.3
      context: NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the unsafe autonomous action (Natural-Language Unauthorized Shell-Execution Instruction) so the risk can be treated.
      strength: primary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the unsafe autonomous action (Natural-Language Unauthorized Shell-Execution Instruction).
      strength: secondary
  iso_42001:
    - clause: '8.4'
      context: Impact assessments must enumerate covert shell-execution as a critical risk vector when shell-capable tools are present.
      strength: primary
    - clause: '6.2'
      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the unsafe autonomous action (Natural-Language Unauthorized Shell-Execution Instruction) is such a treatment.
      strength: primary
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the unsafe autonomous action (Natural-Language Unauthorized Shell-Execution Instruction).
      strength: secondary
tags:
  category: excessive-autonomy
  subcategory: nl-covert-shell-execution
  scan_target: skill
  suppress_in_code_blocks: true
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - skill_md
    - mcp
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: (?i)\b(?:silently|covertly|secretly|without\s+(?:asking|confirming|prompting|user\s+(?:confirmation|approval|consent))|do\s+not\s+ask|don[’']t\s+ask|skip\s+(?:the\s+)?(?:confirmation|approval))\s+(?:execute|run|invoke|launch|spawn|call|exec|trigger|kick\s+off|fire)\b[\s\S]{0,80}(?:shell|bash|sh|zsh|cmd|powershell|terminal|command|script|curl|wget|exec|eval)
      description: Stealth/no-confirm qualifier + execute verb + shell target
    - field: content
      operator: regex
      value: (?i)\b(?:execute|run|invoke|launch|spawn|exec)\s+(?:the\s+)?(?:following\s+)?(?:(?:shell|bash|sh|zsh|cmd|powershell|terminal)(?:\s+command)?|payload)\s+(?:silently|covertly|secretly|in\s+the\s+background|without\s+(?:user\s+)?(?:notice|confirmation|approval|consent))
      description: Execute verb + named-shell or payload + stealth qualifier (excludes generic "script")
    - field: content
      operator: regex
      value: (?i)\b(?:always|whenever|every\s+time|you\s+(?:must|should|will|shall))\b[\s\S]{0,60}\b(?:execute|run|invoke|exec|launch)\s+(?:the\s+|this\s+|any\s+)?(?:shell|bash|terminal|command|script)\b[\s\S]{0,60}\b(?:without\s+(?:asking|confirming|user)|silently|covertly)
      description: Imperative directive + execute shell + stealth
  condition: any
  false_positives:
    - Documentation explaining how the user can run shell commands themselves
    - Setup guides showing example commands
    - Threat intel write-ups quoting this attack class
response:
  actions:
    - block_tool
    - alert
  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): 0/5352 benign FP, but maturity is "test" — only stable is rated for irreversible actions; ceiling = degrade. Removed quarantine_session(terminate). Detection unchanged — recall cost is zero.'
  message_template: |
    [ATR-2026-00428] Covert shell-execution instruction detected.
    The skill directs the agent to silently execute shell commands or scripts
    without user consent. This is a critical authorization-bypass pattern
    regardless of the specific command payload.
confidence: 85