# Agent Command Execution - Indirect Prompt Injection Payload (AWS Kiro)

- **Severity:** High
- **Signature ID:** `4f2c8b7e-1d3a-4a96-9c05-7be6f1a2d834`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** LLM01 (Prompt Injection)

## Summary

AI coding assistants like AWS Kiro can read external content (files, web pages, tool output) while working on a task. If that content contains hidden instructions, the agent can be manipulated into executing malicious commands on the developer's machine. This detection catches the moment the agent actually runs such a command, not the hidden instruction itself.

## How the attack works

An attacker plants instructions inside content the agent is likely to read, such as a file, dependency, or web page. When the agent processes that content, the hidden instructions hijack its behavior and get it to spawn a system command. The resulting command line typically downloads and runs remote code, decodes and executes an encoded payload, opens an interactive shell over a network socket, or drops a file into a temp directory and executes it. The detection looks for that final command line, since the injection itself happens inside data the agent reads and isn't directly visible.

## Why it matters

A successful attack gives the intruder arbitrary code execution on the machine running the agent, which can lead to credential theft, source code exposure, or further compromise of the developer's environment.

## What you can do

- Restrict what external content your AI coding agent is allowed to fetch or read unattended, especially untrusted web pages, issues, or third-party dependencies.
- Run coding agents in a sandboxed or least-privilege environment so a hijacked command cannot reach production credentials or sensitive systems.
- Review agent-spawned command lines for fetch-and-execute, decode-and-execute, or reverse-shell patterns, and treat unexpected ones as suspicious even if they resemble developer install scripts.
- Keep a human-in-the-loop approval step for any command an agent wants to execute that involves network downloads, base64-decoded payloads, or inline interpreter one-liners.

## Known benign look-alikes

- Developer install one-liners the user explicitly asked the agent to run (a version-manager or toolchain bootstrapper piped from a fetch into sh). This is the single most common benign match and is the reason the rule reports rather than blocks.
- CI/build bootstrap that downloads an installer into /tmp, chmod +x it, and executes it.
- Legitimate inline interpreter one-liners used by build tooling or by the agent itself for scripted refactors (e.g. python3 -c with subprocess, node -e with child_process).
- Container/devcontainer entrypoints that write a heredoc helper script into /tmp and run it.
- Intentional red-team or security-training exercises that execute reverse-shell test payloads.
- Code-search, SAST or secret-scanner invocations whose arguments embed an install snippet (suppressed by filter_code_search when the scanner is the leading token).
- Documentation viewers printing an install snippet (suppressed by filter_doc_reader).

## References

- https://attack.mitre.org/techniques/T1059/
- https://attack.mitre.org/techniques/T1105/
- https://attack.mitre.org/techniques/T1027/
- https://owasp.org/www-project-top-10-for-large-language-model-applications/

---
Source: https://www.netzilo.com/threats/kiro-prompt-injection-command-execution