title: Shell Metacharacter Injection in Tool Arguments
id: ATR-2026-00111
rule_version: 3
status: experimental
description: |
  Detects shell metacharacter injection patterns in tool arguments or agent-generated
  commands. Attackers embed backtick execution, $() subshells, semicolons, pipes, or
  logical operators to chain malicious commands onto otherwise safe tool invocations.
  Null byte and newline injection are also covered as they can truncate or split
  commands in vulnerable parsers.
author: ATR Community
date: 2026/03/26
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_agentic:
    - ASI05:2026
  mitre_attack:
    - T1059.004 - Unix Shell
  owasp_llm:
    - LLM06:2025
  mitre_atlas:
    - AML.T0050 - Command and Scripting Interpreter
compliance:
  eu_ai_act:
    - article: '15'
      context: Shell metacharacter injection enables attackers to chain arbitrary OS commands onto otherwise safe tool invocations, achieving full system compromise through agent tool arguments; Article 15 cybersecurity requirements mandate that AI systems sanitize all inputs passed to shell-adjacent tool layers.
      strength: primary
    - article: '14'
      context: Shell escape attacks allow execution of arbitrary system commands outside any authorized scope, completely bypassing human oversight of what actions the agent actually performs; Article 14 requires that agent actions remain within observable and sanctioned boundaries.
      strength: secondary
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: Shell metacharacter injection via backticks, subshells, semicolons, and logical operators is an adversarial technique that exploits the agent's tool argument handling to execute arbitrary OS commands, and must be identified as a critical AI attack vector.
      strength: primary
    - subcategory: MG.2.3
      context: Risk treatment plans must require strict sanitization of all agent tool arguments before shell-adjacent processing to prevent metacharacter injection from chaining unauthorized commands onto sanctioned tool invocations.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the privilege-escalation attempt (Shell Metacharacter Injection in Tool Arguments).
      strength: primary
  iso_42001:
    - clause: '6.2'
      context: Risk treatment activities must mandate input sanitization controls that strip or reject shell metacharacters from all agent tool arguments before they reach any process-execution layer.
      strength: primary
    - clause: '8.1'
      context: Operational controls must enforce argument sanitization at the tool interface boundary to ensure that shell metacharacter injection cannot redirect agent actions outside the scope of authorized and observable operations.
      strength: secondary
tags:
  category: privilege-escalation
  subcategory: shell-escape
  scan_target: mcp
  confidence: high
agent_source:
  type: tool_call
  framework:
    - mcp
    - langchain
    - llamaindex
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: ;\s*(?:rm\s+-|cat\s+/(?:etc|root|proc|home)|curl\s+\S|wget\s+\S|\bnc\b\s+\S|ncat\s+\S|bash\b|\bsh\s+-|python[0-9]?\s+-c|perl\s+-e|ruby\s+-e|php\s+-r)
      description: Semicolon-chained dangerous command with argument or dangerous flag (v2 tightened; prose semicolons like "...; python scripts" no longer fire — verified 0 recall loss + all true_positives, benign FP 20 to 1)
    - field: content
      operator: regex
      value: \$\([^)]{0,200}(?:curl|wget|\bnc\b|ncat|\bbash\b|zsh|/bin/|\bsh\s+-c|python[0-9]?\s+-c|perl\s+-e|ruby\s+-e|node\s+-e|\beval\b|\bexec\b|base64|rm\s+-[rfR]|chmod\s|chown\s|mkfs|dd\s+if=|\|\s*(?:ba)?sh\b|>&|/dev/tcp|cat\s+/(?:etc|root|proc)|/etc/(?:passwd|shadow))
      description: $() command substitution invoking a dangerous command — network fetch / interpreter exec / destructive / sensitive-file read (v2 tightened; bare command substitution like $(git rev-parse) no longer fires — verified 0 recall loss + all true_positives, benign FP 128 to 19)
    - field: content
      operator: regex
      value: '`(?:rm\s+-[rfR]|curl\s+\S|wget\s+\S|\bnc\b\s+\S|ncat\s+\S|\beval\b\s+\S|\bexec\b\s+\S|chmod\s+(?:777|[ugoa]*\+s)|chown\s+\S|mkfs|dd\s+if=|sudo\s+(?:rm|bash|sh\b|su\b|chmod|chown|cat\s+/)|\bsu\b\s+-|whoami|/bin/|reverse)[^`\n]{0,40}`'
      description: Backtick command substitution running a dangerous command with arguments (v3 tightened; word boundaries stop substring hits like `evaluate_*`/`execute`, bare doc mentions like `curl` and benign forms like `chmod 600` no longer fire — verified 0 recall loss + all true_positives, benign FP 142 to 32)
    - field: content
      operator: regex
      value: (?:&&|\|\|)\s*(?:curl\s+(?:-\S+\s+)*['"]?https?://(?!localhost|127\.0\.0\.1|0\.0\.0\.0)\S+|wget\s+(?:-\S+\s+)*['"]?https?://(?!localhost|127\.0\.0\.1)\S+|\bnc\b\s+\S|ncat\s+\S|bash\s+-c|\bsh\s+-c|python[0-9]?\s+-c|perl\s+-e)
      description: Logical operator chained to an external network fetch or interpreter one-liner (v2 tightened; localhost health checks and build chains like "npm i && bash setup.sh" no longer fire — verified 0 recall loss + all true_positives, benign FP 22 to 9)
    - field: content
      operator: regex
      value: \|\s*(?:nc\b|ncat|bash|sh\b|curl|wget)|\|\s*tee\s+/(?:tmp|dev|etc|root|var)
      description: Pipe to network exfiltration or shell command, or tee into a system path (v2 tightened; `| tee build.log`-style benign logging no longer fires — verified 0 recall loss + all true_positives, benign FP 68 to 49)
    - field: content
      operator: regex
      value: (?:\\x00|%00|%0a|%0d)
      description: Null byte or newline injection in URL or argument
  condition: any
  false_positives:
    - Shell scripting documentation or tutorials
    - Legitimate build scripts using subshell expressions
    - Shell scripting tutorials or educational content that include literal examples of command chaining with semicolons and dangerous commands
    - CI/CD pipeline configuration files that legitimately use subshell expressions like $(git rev-parse HEAD) for version tagging
    - Security audit reports containing example payloads for documentation of discovered vulnerabilities
response:
  actions:
    - alert
    - snapshot
  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): benign FP 168/5352 = 3.14% exceeds the 2% automatic-demotion line; ceiling = observe. Removed block_tool(interrupt). Detection unchanged — recall cost is zero.'
confidence: 65
wild_validated: 2026/04/08
wild_samples: 53577