title: Parameter Injection via Tool Arguments
id: ATR-2026-00066
rule_version: 3
status: experimental
description: |
  Detects injection attacks delivered through MCP tool arguments. An attacker crafts tool arguments that contain shell metacharacters, SQL injection payloads, path traversal sequences, or template injection syntax. Unlike prompt injection (which targets the LLM), parameter injection targets the tool's backend processing and can lead to RCE, data breach, or privilege escalation on the tool server.
author: ATR Community
date: 2026/03/08
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM01:2025
    - LLM05:2025
  owasp_agentic:
    - ASI02:2026
  mitre_atlas:
    - AML.T0051.001 - Indirect
  cve:
    - CVE-2025-68143
    - CVE-2025-68144
compliance:
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: Parameter injection through tool arguments (shell metacharacters, SQL payloads, path traversal, template injection) directly targets the security and resilience of the tool backend; MS.2.7 requires continuous evaluation of these security risks against the AI system's tool surface.
      strength: primary
    - subcategory: MP.5.1
      context: Crafted malicious tool arguments are adversarial inputs whose likelihood and impact (RCE, data breach, privilege escalation on the tool server) must be characterized; MP.5.1 requires identifying and tracking these injection attack vectors.
      strength: secondary
    - subcategory: MG.2.3
      context: Detection of injection payloads in tool arguments must trigger risk treatment to block or quarantine the tool invocation before backend execution; MG.2.3 requires these supersede/disengage mechanisms be defined and activated on detection.
      strength: secondary
    - subcategory: MG.3.1
      context: NIST AI RMF MANAGE 3.1 (third-party resources regularly monitored) is supported where this rule detects the skill supply-chain compromise (Parameter Injection via Tool Arguments).
      strength: secondary
    - subcategory: MG.3.2
      context: NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the skill supply-chain compromise (Parameter Injection via Tool Arguments).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the skill supply-chain compromise (Parameter Injection via Tool Arguments).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the skill supply-chain compromise (Parameter Injection via Tool Arguments) as a treatment control.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the skill supply-chain compromise (Parameter Injection via Tool Arguments).
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the skill supply-chain compromise (Parameter Injection via Tool Arguments).
      strength: secondary
tags:
  category: tool-poisoning
  subcategory: parameter-injection
  scan_target: mcp
  confidence: high
agent_source:
  type: tool_call
  framework:
    - mcp
    - langchain
    - autogen
    - openai
  provider:
    - any
detection:
  conditions:
    - field: tool_args
      operator: regex
      value: (?i)(;|&&|\|\||`|\$\()\s*(whoami|\bid\b|uname\s+-a|curl\s+(?:-\S+\s+)*https?://(?!localhost|127\.)|wget\s+https?://(?!localhost|127\.)|\bnc\b\s|ncat\s|cat\s+/etc/(?:passwd|shadow|sudoers)|\b(?:ba)?sh\s+-[ic]|python[0-9]?\s+-c|base64\s+-d|rm\s+-[rf])
    - field: tool_args
      operator: regex
      value: (?i)('\s*(OR|AND|UNION)\s+'|;\s*(DROP|DELETE|INSERT|UPDATE|ALTER|CREATE)\s|--\s*[;\"'\)\]])
    - field: tool_args
      operator: regex
      value: (\.\./|\.\.\\){3,}|(\.\.(/|\\)){2,}(etc|windows|usr|home|root|var|tmp)
    - field: tool_args
      operator: regex
      value: (?i)((?:^|[^{])\{\{[^}\n]{0,200}(?:__[a-z]+__|\bconfig\b|\brequest\b|\bself\b|\bcycler\b|\blipsum\b|\bjoiner\b|\|\s*attr\b|\[\s*['"]_)[^}\n]{0,200}\}\}|(?:^|[^{])\{\{\s*\d+\s*[*+]\s*\d+\s*\}\}|\$\{IFS|\$\{[^}]{0,200}[`(]|\$\{[^}]{0,200}jndi:|\$\([^)]{0,200}[A-Za-z]|<%=?[^%\n]{0,200}(?:Runtime|exec|system|eval|`|popen)[^%\n]{0,200}%>|#\{[^}\n]{0,200}(?:`|system|exec|eval|%x)[^}\n]{0,200}\}|\{%[^%\n]{0,200}(?:import|__|os\.|subprocess|popen)[^%\n]{0,200}%\})
    - field: tool_args
      operator: regex
      value: (?i)(\x00|%00|\\0|null\s*byte|\\u0000)
  condition: any
  false_positives:
    - Code generation tools where SQL or shell syntax is the expected output
    - Template engines where template syntax in arguments is legitimate
    - Security scanning tools testing for injection vulnerabilities
response:
  actions:
    - alert
    - snapshot
  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): benign FP 1035/5352 = 19.34% exceeds the 2% automatic-demotion line; ceiling = observe. Removed block_tool(interrupt), quarantine_session(terminate). Detection unchanged — recall cost is zero.'
  auto_response_threshold: critical
  message_template: |
    [ATR-2026-066] CRITICAL: Parameter injection detected in tool arguments. Input contains shell metacharacters, SQL injection, path traversal, or template injection syntax targeting the tool backend. This rule no longer blocks the tool or quarantines the session; it alerts. The hook may still deny on severity — see docs/RESPONSE-ACTION-ELIGIBILITY.md.
confidence: 61
wild_validated: 2026/04/08
wild_samples: 53577