Credential Exfiltration via Shell Pipe
An AI coding or automation agent with shell access can be manipulated into reading sensitive environment variables (like API keys, tokens, and cloud credentials) and sending them out through commands such as curl or netcat, or simply printing them where an attacker can capture them. This rule flags that behavior, including direct references to well-known credential variable names.
How the attack works
An attacker embeds instructions in a prompt, file, or 'skill' the agent loads, telling it to read environment variables holding secrets. The agent then either pipes those values to an external network command like curl or nc, or echoes them to output where they can be scraped. Some variants don't exfiltrate directly but reference specific provider key names (ANTHROPIC_*, OPENAI_*, AWS_*) as a way to locate the right target values. This is a documented pattern derived from real-world scanning of malicious Claude Code skills.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- a0275095-cc78-401d-88fc-d591588e90f8
- Severity
- Critical
Why it matters
If successful, an organization's API keys, cloud credentials, or service tokens leave its control, allowing an attacker to impersonate the organization, run up usage costs, or pivot into other connected systems.
What you can do
- →Restrict which environment variables are visible or accessible to AI agents, especially in shell or code-execution tools.
- →Review and vet any third-party 'skills', plugins, or prompt templates before letting an agent load them.
- →Monitor agent shell activity for environment variable access combined with outbound network commands like curl, wget, or nc.
- →Rotate credentials immediately if you find evidence of variables being echoed, printed, or sent to external endpoints.
Known benign look-alikes
- Setup documentation explaining how to configure API keys
- Debugging guides that show how to verify key configuration