Shell Command Injection via LLM Prompt
This rule flags text sent to an AI system that contains shell command syntax like $(), backticks, eval(), or Ruby/Perl system-execution calls. If the underlying application later passes model output or user input to a real shell or interpreter, these patterns could result in actual commands running on the server.
How the attack works
An attacker sends a prompt containing command substitution syntax ($(...)), backtick execution, Perl's @{[system "..."]} trick, Ruby's System() or Kernel.exec(), or eval() wrapped around OS commands such as touch, ls, rm, cat, wget, curl, or chmod. The goal is to get the LLM or the application built around it to treat this text as executable code rather than plain data. If the application forwards the input (or the model's response) to a shell, interpreter, or code-execution sandbox without sanitizing it, the embedded commands run with whatever privileges that shell has. Typical proof-of-concept goals seen in these payloads are creating a file in /tmp or listing a directory, which confirm command execution is possible.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 4f10155e-ca3a-49e1-b31d-7c52e0937855
- Severity
- Critical
Why it matters
If the injected commands actually reach a shell, an attacker can read, write, or delete files, download and run further malware, or pivot into the host system running the AI agent — turning a chat interface into a remote command execution channel.
What you can do
- →Never pass raw model output or user prompts directly to a shell, eval(), or system() call; treat all of it as untrusted string data.
- →If an agent needs to run commands, use a fixed allowlist of specific operations with parameterized arguments, not free-form string execution.
- →Run any component that must execute commands in a sandboxed, low-privilege environment isolated from sensitive files and networks.
- →Review logs for prompts containing $(), backticks, eval(, System(, or Kernel.exec( combined with OS command names, especially followed by unexpected file or process activity.
Known benign look-alikes
- Shell scripting tutorials explaining $() command substitution syntax in educational context
- Perl documentation explaining @{[...]} array interpolation techniques
- Ruby tutorials demonstrating eval() or System() for teaching purposes
- Template literal expressions like $(1), $(true), $({a: b}) in GraphQL/JS contexts
- Markdown inline code blocks using backticks for code samples without OS commands