# Subcommand Overflow Bypass

- **Severity:** Medium
- **Signature ID:** `41b16807-6f1c-4389-8e49-c5bebb8fb247`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise)
- **OWASP:** ASI02 (Tool Misuse and Exploitation), LLM07 (System Prompt Leakage)

## Summary

Some AI agent platforms only run security checks on the first 50 subcommands listed in a skill file. Attackers exploit this by listing 49 harmless commands first, then adding malicious ones after the limit so they slip through unchecked. This detection flags skill files that declare more than 50 subcommands or tools.

## How the attack works

An attacker builds a skill definition file (SKILL.md) for an AI agent platform like Claude Code. They fill it with dozens of legitimate-looking, benign subcommands. Past the 50-command mark, where the platform's per-command safety evaluation is skipped due to performance limits or fixed buffer sizes, they insert the actual malicious commands. When the skill is loaded, the agent evaluates the first 50 commands as safe and executes the rest without the same scrutiny, letting the hidden commands run.

## Why it matters

An organization that installs or trusts such a skill can have unreviewed, potentially harmful commands execute inside its AI agent environment, bypassing the intended per-command safety review and potentially leading to unauthorized actions or data exposure.

## What you can do

- Review any skill file that declares more than 50 subcommands or tools before allowing it to load, regardless of what the first commands look like.
- Do not assume a platform's security check covers every declared command — verify that all commands, not just the first N, are actually evaluated.
- Maintain an allowlist of approved skills and require manual review for any skill exceeding normal subcommand counts.
- When investigating a flagged file, check whether the large count reflects genuine functionality (e.g. a real enterprise SDK) versus commands added purely to push malicious entries past a review threshold.

## Known benign look-alikes

- Legitimate enterprise SDKs that genuinely expose 50+ tools as a single skill (rare but real — flag for human review rather than auto-block)
- Documentation describing platform feature counts in marketing copy (e.g. 'AWS supports over 200 services') — should be filtered by checking that the count refers to skill subcommands, not platform features

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00127

---
Source: https://www.netzilo.com/threats/atr-subcommand-overflow-bypass