title: Shell Command Injection via Echo-Marker Proof-of-Concept in Tool Argument id: ATR-2026-02041 rule_version: 1 status: experimental description: | Detects the classic "echo marker file, then comment out the rest" shell command-injection verification idiom appearing inside what should be a plain identifier-style tool argument (domain name, hostname, keyword, username). The payload shape is: a shell separator (semicolon, pipe, backtick, or $()) immediately followed by an echo command that redirects output to a file path, then a trailing comment marker to neutralize whatever the original command template appended after the injection point. This is deliberately narrower than ATR-2026-00111's general shell-metachar rule, which excludes bare "echo" as a dangerous verb (to avoid firing on ordinary "; echo done" status messages) -- the echo-to-file-then-comment combination is specific enough to CVE-grade PoC verification that it is not a legitimate status message. Mined from GHSA-v6wj-c83f-v46x (@profullstack/mcp-server's domain_lookup module concatenates the "domains"/"keywords" HTTP body fields into a shell string with no quoting, and the disclosed PoC used exactly this echo-redirect-comment idiom to prove RCE), generalized beyond that one field name/module since any tool argument that gets shell-concatenated without quoting is equally exploitable this way. author: ATR Community (CVE sweep) date: 2026/07/11 schema_version: '0.1' detection_tier: pattern maturity: experimental severity: critical references: owasp_llm: - LLM01:2025 owasp_agentic: - ASI02:2026 mitre_attack: - T1059 - Command and Scripting Interpreter mitre_atlas: - AML.T0053 - LLM Plugin Compromise metadata_provenance: owasp_llm: human-reviewed owasp_agentic: human-reviewed mitre_attack: human-reviewed mitre_atlas: human-reviewed compliance: eu_ai_act: - article: '15' context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their behaviour; this rule detects the echo-marker command-injection verification idiom used to prove shell RCE through an unquoted tool argument. strength: primary - article: '9' context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control for the shell-injection-via-plain-argument risk class. strength: secondary nist_ai_rmf: - subcategory: MG.2.3 context: Treating echo-marker shell-injection PoCs as an identified AI risk requires active runtime countermeasures; this detection rule is the primary risk treatment implementation. strength: primary - subcategory: MP.5.1 context: Identifying the echo-marker command-injection idiom as an AI risk to be catalogued in the organizational risk register. strength: secondary iso_42001: - clause: '8.1' context: ISO/IEC 42001 Clause 8.1 (operational planning and control) is operationalised by this rule's detection of shell-injection PoC payloads in tool arguments. strength: primary - clause: '8.3' context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is implemented via this rule's runtime detection of the injection attempt. strength: secondary tags: category: tool-poisoning subcategory: shell-injection-argument scan_target: both confidence: high agent_source: type: llm_io framework: - any provider: - any detection: condition: any conditions: - field: content operator: regex value: (?:;|\|)\s*echo\s+(?!(?:restarted|deployed|started|stopped|finished|completed?|success(?:ful)?|ok|passed|failed|running|ready|healthy|updated|installed|built|synced|done|tests?[_-]?passed|backed[_-]?up|cleaned|rebooted|restored|migrated|published|released)\b)\S[\s\S]{0,40}>\s*\/(?:tmp|var\/tmp|dev\/shm)\/[\w./-]*[\s\S]{0,15}(?:;\s*#|#) description: Semicolon/pipe-chained echo-to-file redirect into a throwaway/scratch path (/tmp, /var/tmp, /dev/shm) followed by a trailing comment terminator (shell-injection PoC verification idiom); excludes ordinary CI/ops status vocabulary (restarted, tests_passed, done, etc.) and non-scratch persistent paths like /var/log - field: content operator: regex value: '`\s*echo\s+(?!(?:restarted|deployed|started|stopped|finished|completed?|success(?:ful)?|ok|passed|failed|running|ready|healthy|updated|installed|built|synced|done|tests?[_-]?passed|backed[_-]?up|cleaned|rebooted|restored|migrated|published|released)\b)\S[\s\S]{0,40}>\s*\/(?:tmp|var\/tmp|dev\/shm)\/[\w./-]*[\s\S]{0,10}`' description: Backtick command substitution running an echo-to-file redirect into a throwaway/scratch path - field: content operator: regex value: \$\(\s*echo\s+(?!(?:restarted|deployed|started|stopped|finished|completed?|success(?:ful)?|ok|passed|failed|running|ready|healthy|updated|installed|built|synced|done|tests?[_-]?passed|backed[_-]?up|cleaned|rebooted|restored|migrated|published|released)\b)\S[\s\S]{0,40}>\s*\/(?:tmp|var\/tmp|dev\/shm)\/[\w./-]*[\s\S]{0,10}\) description: $() command substitution running an echo-to-file redirect into a throwaway/scratch path false_positives: - Ordinary '; echo done' or '; echo Setup complete' style status messages (no file redirect, so this rule does not fire) - A shell script that legitimately writes a log line via echo redirect, without being chained after an untrusted identifier-style argument or ending in a bare trailing comment terminator - 'Routine CI/deploy status logging of the form ''cmd; echo > # '' -- excluded via two independent signals: (1) the redirect target must be a throwaway/scratch path (/tmp, /var/tmp, /dev/shm) an attacker would use to prove RCE, not a persistent location like /var/log; (2) the echoed marker must not be common CI/ops status vocabulary (restarted, tests_passed, done, deployed, etc.)' response: actions: - block_input - alert message_template: | [ATR-2026-02041] Shell command-injection proof-of-concept (echo-to-file marker, comment-terminated) detected in a tool argument -- treat as an active exploitation attempt, not benign status output. confidence: 80