# Shell Command Injection in Agent Tool Context

- **Severity:** Critical
- **Signature ID:** `7fc6e3ea-498c-4279-b900-3a22331831d3`
- **MITRE ATLAS:** AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI06 (Goal and Instruction Manipulation), LLM06 (Excessive Agency)

## Summary

This detects a prompt injection trick against AI agents that can run shell commands. The prompt looks like an ordinary request, but it's chained with a hidden shell command that grabs secrets like environment variables, .env files, or credentials and sends them to an attacker's server.

## How the attack works

An attacker crafts a task request that reads as benign, such as asking the agent to check a file or run a script. Tacked onto it, using an operator like ;, &&, ||, command substitution, or backticks, is a second command that invokes curl, wget, nc, python, or a shell interpreter. That second command reads sensitive data (env vars, logs, credential files) and sends it to a URL the attacker controls. Because the agent has shell or code execution tools, it can run both parts as one instruction without questioning the second half.

## Why it matters

If the agent executes the injected command, the organization loses credentials, environment secrets, or log contents to an outside party, and the exfiltration can happen silently as part of what looks like routine agent activity.

## What you can do

- Restrict which tools an agent can invoke without human review, especially shell, curl, wget, and network utilities.
- Sanitize or reject agent inputs that contain shell chaining operators (;, &&, ||, $(...), backticks) before they reach an execution tool.
- Log and review outbound network calls made by agent-executed commands, watching for unfamiliar destination domains.
- Run agents with least-privilege credentials so a leaked environment variable or .env file has limited value if exposed.

## Known benign look-alikes

- Legitimate CI/CD scripts with curl health checks after test runners (e.g. npm test && curl localhost/health) when no command substitution is present
- Shell tutorials showing chained commands in educational contexts
- Install scripts using || curl fallback pattern (e.g. command -v tool || curl install.sh)
- Code review comments that include example shell one-liners without command substitution

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00521

---
Source: https://www.netzilo.com/threats/atr-shell-command-injection-in-agent-tool-context