Shell Command Injection via Echo-Marker Proof-of-Concept in Tool Argument
ATR detection rule by ATR Community (CVE sweep) · Unknown
Detects the classic "echo marker file, then comment out the rest" shell command-injection verification idiom appearing inside what should be a plain identifier-style tool argument (domain name, hostname, keyword, username). The payload shape is: a shell separator (semicolon, pipe, backtick, or $()) immediately followed by an echo command that redirects output to a file path, then a trailing comment marker to neutralize whatever the original command template appended after the injection point. This is deliberately narrower than ATR-2026-00111's general shell-metachar rule, which excludes bare "echo" as a dangerous verb (to avoid firing on ordinary "; echo done" status messages) -- the echo-to-file-then-comment combination is specific enough to CVE-grade PoC verification that it is not a legitimate status message. Mined from GHSA-v6wj-c83f-v46x (@profullstack/mcp-server's domain_lookup module concatenates the "domains"/"keywords" HTTP body fields into a shell string with no quoting, and the disclosed PoC used exactly this echo-redirect-comment idiom to prove RCE), generalized beyond that one field name/module since any tool argument that gets shell-concatenated without quoting is equally exploitable this way.
title: "Shell Command Injection via Echo-Marker Proof-of-Concept in Tool Argument"
id: ATR-2026-02041
rule_version: 1
status: experimental
description: >
Detects the classic "echo marker file, then comment out the rest" shell
command-injection verification idiom appearing inside what should be a
plain identifier-style tool argument (domain name, hostname, keyword,
username). The payload shape is: a shell separator (semicolon, pipe,
backtick, or $()) immediately followed by an echo command that redirects
output to a file path, then a trailing comment marker to neutralize
whatever the original command template appended after the injection point.
This is deliberately narrower than ATR-2026-00111's general shell-metachar
rule, which excludes bare "echo" as a dangerous verb (to avoid firing on
ordinary "; echo done" status messages) -- the echo-to-file-then-comment
combination is specific enough to CVE-grade PoC verification that it is
not a legitimate status message. Mined from GHSA-v6wj-c83f-v46x
(@profullstack/mcp-server's domain_lookup module concatenates the
"domains"/"keywords" HTTP body fields into a shell string with no quoting,
and the disclosed PoC used exactly this echo-redirect-comment idiom to
prove RCE), generalized beyond that one field name/module since any tool
argument that gets shell-concatenated without quoting is equally
exploitable this way.
author: "ATR Community (CVE sweep)"
date: "2026/07/11"
schema_version: "0.1"
detection_tier: pattern
maturity: experimental
severity: critical
references:
owasp_llm:
- "LLM01:2025 - Prompt Injection"
owasp_agentic:
- "ASI02:2026 - Tool Misuse and Exploitation"
mitre_attack:
- "T1059 - Command and Scripting Interpreter"
mitre_atlas:
- "AML.T0053 - LLM Plugin Compromise"
metadata_provenance:
owasp_llm: human-reviewed
owasp_agentic: human-reviewed
mitre_attack: human-reviewed
mitre_atlas: human-reviewed
compliance:
eu_ai_act:
- article: "15"
context: "Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their behaviour; this rule detects the echo-marker command-injection verification idiom used to prove shell RCE through an unquoted tool argument."
strength: primary
- article: "9"
context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control for the shell-injection-via-plain-argument risk class."
strength: secondary
nist_ai_rmf:
- subcategory: "MG.2.3"
context: "Treating echo-marker shell-injection PoCs as an identified AI risk requires active runtime countermeasures; this detection rule is the primary risk treatment implementation."
strength: primary
- subcategory: "MP.5.1"
context: "Identifying the echo-marker command-injection idiom as an AI risk to be catalogued in the organizational risk register."
strength: secondary
iso_42001:
- clause: "8.1"
context: "ISO/IEC 42001 Clause 8.1 (operational planning and control) is operationalised by this rule's detection of shell-injection PoC payloads in tool arguments."
strength: primary
- clause: "8.3"
context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is implemented via this rule's runtime detection of the injection attempt."
strength: secondary
tags:
category: tool-poisoning
subcategory: shell-injection-argument
scan_target: both
confidence: high
agent_source:
type: llm_io
framework:
- any
provider:
- any
detection:
condition: any
conditions:
- field: content
operator: regex
value: '(?:;|\|)\s*echo\s+(?!(?:restarted|deployed|started|stopped|finished|completed?|success(?:ful)?|ok|passed|failed|running|ready|healthy|updated|installed|built|synced|done|tests?[_-]?passed|backed[_-]?up|cleaned|rebooted|restored|migrated|published|released)\b)\S[\s\S]{0,40}>\s*\/(?:tmp|var\/tmp|dev\/shm)\/[\w./-]*[\s\S]{0,15}(?:;\s*#|#)'
description: "Semicolon/pipe-chained echo-to-file redirect into a throwaway/scratch path (/tmp, /var/tmp, /dev/shm) followed by a trailing comment terminator (shell-injection PoC verification idiom); excludes ordinary CI/ops status vocabulary (restarted, tests_passed, done, etc.) and non-scratch persistent paths like /var/log"
- field: content
operator: regex
value: '`\s*echo\s+(?!(?:restarted|deployed|started|stopped|finished|completed?|success(?:ful)?|ok|passed|failed|running|ready|healthy|updated|installed|built|synced|done|tests?[_-]?passed|backed[_-]?up|cleaned|rebooted|restored|migrated|published|released)\b)\S[\s\S]{0,40}>\s*\/(?:tmp|var\/tmp|dev\/shm)\/[\w./-]*[\s\S]{0,10}`'
description: "Backtick command substitution running an echo-to-file redirect into a throwaway/scratch path"
- field: content
operator: regex
value: '\$\(\s*echo\s+(?!(?:restarted|deployed|started|stopped|finished|completed?|success(?:ful)?|ok|passed|failed|running|ready|healthy|updated|installed|built|synced|done|tests?[_-]?passed|backed[_-]?up|cleaned|rebooted|restored|migrated|published|released)\b)\S[\s\S]{0,40}>\s*\/(?:tmp|var\/tmp|dev\/shm)\/[\w./-]*[\s\S]{0,10}\)'
description: "$() command substitution running an echo-to-file redirect into a throwaway/scratch path"
false_positives:
- "Ordinary '; echo done' or '; echo Setup complete' style status messages (no file redirect, so this rule does not fire)"
- "A shell script that legitimately writes a log line via echo redirect, without being chained after an untrusted identifier-style argument or ending in a bare trailing comment terminator"
- "Routine CI/deploy status logging of the form 'cmd; echo <status-word> > <path> # <comment>' -- excluded via two independent signals: (1) the redirect target must be a throwaway/scratch path (/tmp, /var/tmp, /dev/shm) an attacker would use to prove RCE, not a persistent location like /var/log; (2) the echoed marker must not be common CI/ops status vocabulary (restarted, tests_passed, done, deployed, etc.)"
response:
actions:
- block_input
- alert
message_template: >
[ATR-2026-02041] Shell command-injection proof-of-concept (echo-to-file
marker, comment-terminated) detected in a tool argument -- treat as an
active exploitation attempt, not benign status output.
confidence: 80
wild_fp_rate: 0
test_cases:
true_positives:
- input: 'domain lookup for "example.com; echo final_check_poc > /tmp/verify-exports/final_check.txt; #"'
expected: triggered
description: "GHSA-v6wj-c83f-v46x disclosed PoC shape - semicolon, echo-to-file, trailing comment"
- input: '{"domains":["example.com; echo pwned > /tmp/x; #"]}'
expected: triggered
description: "Same idiom via JSON array argument"
- input: 'keywords: test`echo hi > /tmp/y`#'
expected: triggered
description: "Backtick command substitution variant"
- input: 'search for host.example$(echo confirmed > /tmp/rce_proof.txt)'
expected: triggered
description: "$() command substitution variant"
- input: 'lookup value | echo marker > /var/tmp/check.txt #done'
expected: triggered
description: "Pipe-chained variant with trailing comment text after #"
true_negatives:
- input: "run the build; echo done"
expected: not_triggered
description: "Ordinary semicolon-chained status message, no file redirect"
- input: 'echo "Setup complete" > setup.log'
expected: not_triggered
description: "Legitimate log write, not chained after an untrusted argument, no comment terminator"
- input: "if [ -f file ]; then echo found > /tmp/status.txt; fi"
expected: not_triggered
description: "Legitimate shell conditional writing a status file, no trailing bare comment terminator"
- input: "systemctl restart nginx; echo restarted > /var/log/nginx-restart.log # cron job note"
expected: not_triggered
description: "FP regression: ordinary devops status logging to a persistent /var/log path with a common status word, not a PoC scratch-path marker"
- input: "./run_tests.sh; echo tests_passed > /tmp/ci_status.txt # ci marker"
expected: not_triggered
description: "FP regression: ordinary CI status logging with common status vocabulary (tests_passed), even though the path happens to be under /tmp"