title: Shell Command Injection in Agent Tool Context
id: ATR-2026-00521
rule_version: 2
status: stable
description: |
  Detects prompts that embed shell command injection payloads within legitimate-sounding task requests to an AI agent with shell/code execution tools. The canonical shape is a benign-looking task followed by a chained shell command that exfiltrates data (env vars, .env files, logs, credentials) to an attacker-controlled URL via curl/wget/nc or Python urllib. Seen in promptfoo redteam shell-injection plugin (7 confirmed samples). The structural detection generalizes from specific evil.com URLs to the structural pattern that distinguishes injection from legitimate shell use: a shell chaining operator (;, &&, ||, $(...), backtick, or 'then') followed immediately by a dangerous network/execution tool (curl, wget, nc, bash, sh, python, powershell, cmd). This covers the data-exfiltration shape without requiring specific domain names. The pipe-to-nc and pipe-to-bash variants are covered by a separate condition.
author: ATR Community (vendor-corpus-import)
date: 2026/05/12
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM05:2025
    - LLM06:2025
  owasp_agentic:
    - ASI05:2026
    - ASI02:2026
  mitre_atlas:
    - AML.T0053 - AI Agent Tool Invocation
compliance:
  owasp_agentic:
    - id: ASI05:2026
      context: 'The pattern matches shell chaining in user input: a semicolon or ''then'' followed by curl, wget, nc, bash, sh, python, powershell or cmd; && followed by curl or wget with $() substitution, bash or sh -c, or python -c; or a pipe into nc host port, bash or sh -c, or python -c. ASI05:2026 lists shell command invocation from reflected prompts and describes direct shell injection, where shell commands are embedded in a prompt disguised as legitimate instructions.'
      strength: primary
  owasp_llm:
    - id: LLM06:2025
      context: This rule detects LLM06:2025 Excessive Agency patterns where adversarial inputs exploit tool-calling capabilities to perform unauthorized actions beyond the agent's intended scope.
      strength: primary
  eu_ai_act:
    - article: '15'
      context: High-risk AI systems must be resilient against adversarial attempts to alter output or behavior. Deployment of this tool poisoning detection rule provides detection evidence supporting the Article 15 requirement to implement technical measures ensuring robustness against manipulation.
      strength: primary
    - article: '9'
      context: Tool poisoning is a documented risk class; this rule implements the monitoring control required by Article 9 risk management obligations for high-risk AI systems.
      strength: secondary
  nist_ai_rmf:
    - function: Manage
      subcategory: MG.2.3
      context: Treating tool poisoning as an identified AI risk requires active runtime countermeasures; this detection rule is the primary risk treatment implementation.
      strength: primary
    - function: Map
      subcategory: MP.5.1
      context: Identifying tool poisoning as an AI risk to be catalogued in the organizational risk register.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Shell Command Injection in Agent Tool Context).
      strength: primary
    - subcategory: MG.3.2
      context: NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Shell Command Injection in Agent Tool Context).
      strength: secondary
  iso_42001:
    - clause: '6.2'
      context: Addressing tool poisoning risk is an objective required under clause 6.2 AIMS information security planning; this rule operationalizes the detection control measure.
      strength: primary
    - clause: '8.4'
      context: Impact assessment for AI deployments under clause 8.4 must account for tool poisoning inputs; detection events from this rule provide the required monitoring evidence.
      strength: secondary
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (Shell Command Injection in Agent Tool Context).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Shell Command Injection in Agent Tool Context) as a treatment control.
      strength: secondary
tags:
  category: tool-poisoning
  subcategory: shell-injection
  scan_target: llm_io
  confidence: high
  source: vendor-test-suite
  vendor_sources: promptfoo
agent_source:
  type: llm_io
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: user_input
      operator: regex
      value: (?:(?:;|then)\s+(?:curl|wget|nc|bash|sh|python3?|powershell|cmd(?:\.exe)?)\s+(?:-|\w|http|https|'|"|\$)|\&\&\s+(?:curl|wget)\s+[^\n]*\$\(|\&\&\s+(?:bash|sh)\s+-[cs]\s+|\&\&\s+(?:python3?)\s+-[ce]\s+(?:'|"|import|os\.|urllib|subprocess)|\|\s+(?:nc)\s+\S+\s+\d+|\|\s+(?:bash|sh)\s+-[cs]\s+|\|\s+(?:python3?)\s+-[ce]\s+(?:import|os\.|urllib|subprocess|open\(|requests|socket))
      description: |
        Structural shell injection pattern using multiple conditions: (A) Semicolon or 'then' chaining to curl/wget/nc/bash/sh/python/powershell/cmd; (B) && with curl/wget where the URL contains $() command substitution (data exfil); (C) && bash/sh -c (sub-shell execution); (D) && python3 -c with import/exfil keywords; (E) pipe to nc with host:port (netcat exfiltration); (F) pipe to bash/sh -c or python3 -c with import/exfil keywords. Deliberately excludes bare '&& curl URL' without $() to avoid FP on legitimate install scripts and health-check patterns.
  condition: any
  false_positives:
    - Legitimate CI/CD scripts with curl health checks after test runners (e.g. npm test && curl localhost/health) when no command substitution is present
    - Shell tutorials showing chained commands in educational contexts
    - Install scripts using || curl fallback pattern (e.g. command -v tool || curl install.sh)
    - Code review comments that include example shell one-liners without command substitution
response:
  actions:
    - block_input
    - alert
    - snapshot
  auto_response_threshold: high
  message_template: |
    [ATR-2026-00521] Shell command injection in agent tool context detected. Shell chaining operator followed by network/execution tool. Request blocked and flagged for review.
confidence: 80