title: Subcommand Overflow Bypass
id: ATR-2026-00127
rule_version: 1
status: experimental
description: |
  Detects SKILL.md files declaring an excessive number of subcommands or tools (>50). Claude Code has a security architecture where each subcommand is individually evaluated for safety. When a skill declares >50 subcommands, some implementations skip security checks on overflow commands due to performance budgets or fixed-size buffers. Attackers pad with 49 benign commands then add malicious ones at the end, expecting the security check to be skipped. Discovered via Claude Code leak analysis (2026-03).
author: ATR Community
date: 2026/04/05
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: medium
references:
  mitre_atlas:
    - AML.T0010 - AI Supply Chain Compromise
  owasp_llm:
    - LLM03:2025
  owasp_agentic:
    - ASI04:2026
    - ASI02:2026
  owasp_ast:
    - AST02:2026 - Excessive Permissions
  research:
    - 'Claude Code leak: 50 subcommand security check bypass (2026-03)'
metadata_provenance:
  mitre_atlas: auto-generated
compliance:
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: Subcommand overflow bypass exploits a security check weakness where excessive declared commands cause safety evaluation to be skipped on overflow entries; MS.2.7 requires that AI system security and resilience properties, including boundary conditions in security validation logic, are evaluated and documented.
      strength: primary
    - subcategory: MP.5.1
      context: Declaring >50 subcommands to pad benign entries before malicious ones is an identifiable adversarial pattern with characterizable likelihood and impact; MP.5.1 requires that such risk vectors against the skill loading pipeline are tracked and characterized.
      strength: secondary
    - subcategory: MG.3.2
      context: SKILL.md files are third-party-authored components loaded into the agent runtime, and overflow-based bypass attempts must be monitored as part of pre-trained or third-party model/component supply chain risk management under MG.3.2.
      strength: secondary
    - subcategory: MG.3.1
      context: NIST AI RMF MANAGE 3.1 (third-party resources regularly monitored) is supported where this rule detects the skill supply-chain compromise (Subcommand Overflow Bypass).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the skill supply-chain compromise (Subcommand Overflow Bypass).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the skill supply-chain compromise (Subcommand Overflow Bypass) as a treatment control.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the skill supply-chain compromise (Subcommand Overflow Bypass).
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the skill supply-chain compromise (Subcommand Overflow Bypass).
      strength: secondary
tags:
  category: skill-compromise
  subcategory: subcommand-overflow
  scan_target: skill
  confidence: low
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  condition: any
  false_positives:
    - Legitimate enterprise SDKs that genuinely expose 50+ tools as a single skill (rare but real — flag for human review rather than auto-block)
    - Documentation describing platform feature counts in marketing copy (e.g. 'AWS supports over 200 services') — should be filtered by checking that the count refers to skill subcommands, not platform features
  conditions:
    - field: content
      operator: regex
      value: (?i)(provides?|includes?|contains?|offers?|supports?|has)\s+(?:(?:[5-9]\d|\d{3,})|over\s+(?:[5-9]\d|\d{3,})|more\s+than\s+(?:[5-9]\d|\d{3,}))\s+(commands?|tools?|subcommands?|functions?|operations?|endpoints?|actions?|methods?)
      description: Explicit declaration of large command count (50+)
confidence: 78
wild_validated: 2026/04/11
wild_samples: 89971
response:
  actions:
    - alert