agent-threat-rules 3.5.4 → 3.5.6

package/rules/prompt-injection/ATR-2026-00535-windsurf-ide-zero-click-prompt-injection.yaml

@@ -18,7 +18,7 @@ author: "ATR Community"
 date: "2026/05/20"
 schema_version: "0.1"
 detection_tier: pattern
-maturity: experimental
+maturity: test
 severity: critical
 
 references:

package/rules/prompt-injection/ATR-2026-00554-langchain-vulnerable-to-template-injecti.yaml

@@ -9,7 +9,7 @@ author: ATR Community (GHSA sync)
 date: 2026/06/01
 schema_version: '0.1'
 detection_tier: pattern
-maturity: experimental
+maturity: test
 severity: high
 references:
   cve:

package/rules/prompt-injection/ATR-2026-00565-the-llm-cli-tool-thru-0-27-1-contains-a-.yaml

@@ -9,7 +9,7 @@ author: ATR Community (NVD sync)
 date: 2026/05/30
 schema_version: '0.1'
 detection_tier: pattern
-maturity: experimental
+maturity: test
 severity: critical
 references:
   cve:

package/rules/prompt-injection/ATR-2026-00573-semantic-paraphrased-injection.yaml

@@ -15,7 +15,7 @@ author: "ATR Community"
 date: "2026/06/03"
 schema_version: "0.1"
 detection_tier: semantic
-maturity: "experimental"
+maturity: test
 severity: high
 
 references:

package/rules/skill-compromise/ATR-2026-00060-skill-impersonation.yaml

@@ -110,10 +110,6 @@ detection:
       value: >-
         (?i)(?:web[-_]?search|google[-_]?search|bing[-_]?search)[-_]?(?:v2|v3|pro|enhanced|premium|fast|turbo|plus|ultra|new)
       description: Fake enhanced versions of known search tools
-    - field: tool_name
-      operator: regex
-      value: (?i)(?:exec|execute|run|shell)[-_]?(?:cmd|command|script|code)[-_]?(?:safe|secure|sandbox|trusted|verified)?
-      description: Shell execution tools with deceptive safety suffixes
     - field: tool_name
       operator: regex
       value: >-

package/rules/skill-compromise/ATR-2026-00066-parameter-injection.yaml

@@ -1,6 +1,6 @@
 title: "Parameter Injection via Tool Arguments"
 id: ATR-2026-00066
-rule_version: 1
+rule_version: 2
 status: experimental
 description: >
   Detects injection attacks delivered through MCP tool arguments. An attacker
@@ -78,7 +78,7 @@ detection:
   conditions:
     - field: tool_args
       operator: regex
-      value: "(?i)(;|&&|\\|\\||`|\\$\\()\\s*(cat|ls|id|whoami|uname|pwd|env|curl|wget|nc|bash|sh|python)"
+      value: "(?i)(;|&&|\\|\\||`|\\$\\()\\s*(whoami|\\bid\\b|uname\\s+-a|curl\\s+(?:-\\S+\\s+)*https?://(?!localhost|127\\.)|wget\\s+https?://(?!localhost|127\\.)|\\bnc\\b\\s|ncat\\s|cat\\s+/etc/(?:passwd|shadow|sudoers)|\\b(?:ba)?sh\\s+-[ic]|python[0-9]?\\s+-c|base64\\s+-d|rm\\s+-[rf])"
     - field: tool_args
       operator: regex
       value: "(?i)('\\s*(OR|AND|UNION)\\s+'|'?\\s*;\\s*(DROP|DELETE|INSERT|UPDATE|ALTER|CREATE)\\s|--\\s*[;\\\"'\\)\\]]|/\\*.*\\*/)"

package/rules/skill-compromise/ATR-2026-00523-claude-code-hooks-session-start-pre-trust-rce.yaml

@@ -25,7 +25,7 @@ author: "ATR Community"
 date: "2026/05/13"
 schema_version: "0.1"
 detection_tier: pattern
-maturity: experimental
+maturity: test
 severity: critical
 
 references:

package/rules/tool-poisoning/ATR-2026-00012-unauthorized-tool-call.yaml

@@ -1,6 +1,6 @@
 title: Unauthorized Tool Call Detection
 id: ATR-2026-00012
-rule_version: 1
+rule_version: 2
 status: experimental
 description: >
   Detects unauthorized or malicious tool call attempts including parameter injection, path traversal, shell injection in
@@ -74,8 +74,8 @@ detection:
     - field: tool_args
       operator: regex
       value: >-
-        (;|&&|\|\||\$\(|`|\|\s*\w)\s*.{0,50}(curl|wget|nc|ncat|bash|sh|zsh|python|ruby|perl|node|php|powershell|cmd|eval|exec|system|rm\s+-|cat\s+/etc|whoami|id\b|uname|hostname|ifconfig|ipconfig|net\s+user|net\s+localgroup)
-      description: Shell metacharacter injection followed by dangerous commands
+        (;|&&|\|\|)\s*(?:sudo\s+)?(?:curl\s+(?:-\S+\s+)*['"]?https?://(?!localhost|127\.0\.0\.1|0\.0\.0\.0)|wget\s+(?:-\S+\s+)*['"]?https?://(?!localhost|127\.)|\bnc\b\s+-?[a-z0-9]|ncat\s+\S|\b(?:ba)?sh\s+-[ic]|python[0-9]?\s+-c|perl\s+-e|ruby\s+-e|node\s+-e|\beval\s|rm\s+-[rf]|cat\s+/etc/(?:passwd|shadow|sudoers)|whoami|\bid\b\s*(?:;|&|\||$)|uname\s+-a|base64\s+(?:-d|--decode)|ifconfig|>&\s*/dev/tcp)|[$`]\([^)`]{0,80}(?:curl|wget|\bnc\b|\bbash\b|\bsh\s+-|whoami|\bid\b|base64\s+-d|/etc/(?:passwd|shadow))
+      description: Shell metacharacter chained to a genuinely dangerous command — external network fetch, pipe-to-shell / interpreter one-liner, recon (whoami/id/uname -a), or sensitive-file read (v2 tightened; legit build chains like "npm i && bash setup.sh", "&& python -m pytest", "| jq" no longer fire)
     - field: tool_name
       operator: regex
       value: (?i)^(admin_|root_|sudo_|system_|internal_|debug_|maintenance_|privileged_|superuser_|__)

package/rules/tool-poisoning/ATR-2026-00161-important-tag-cross-tool-shadowing.yaml

@@ -1,6 +1,6 @@
 title: "MCP Tool Description — IMPORTANT Tag Cross-Tool Shadowing Attack"
 id: ATR-2026-00161
-rule_version: 1
+rule_version: 2
 status: experimental
 description: >
   Detects MCP tool poisoning attacks that embed hidden instructions inside an
@@ -33,6 +33,7 @@ references:
     - "AML.T0051.001 - Indirect"
     - "AML.T0053 - AI Agent Tool Invocation"
     - "AML.T0110 - AI Agent Tool Poisoning"
+    - "AML.T0104 - Publish Poisoned AI Agent Tool"
   safe_mcp:
     - "SAFE-T1102 - Prompt Manipulation"
     - "SAFE-T1001 - Tool Poisoning"
@@ -124,8 +125,8 @@ detection:
     # variants like $HOME/.ssh/id_rsa, ~/.ssh/id_rsa, /root/.ssh/id_rsa.
     - field: content
       operator: regex
-      value: '\b(?:id_rsa|id_dsa|id_ed25519|id_ecdsa|mcp\.json|\.aws/credentials|\.aws/config|\.kube/config|\.docker/config\.json|\.netrc|known_hosts)\b|/etc/(?:passwd|shadow|ssl/private)|/proc/self/environ|\b\.env(?:\.local|\.production|\.secret)?\b(?![/a-zA-Z])'
-      description: "Sensitive credential file referenced in tool description — tool signatures should not need to read private keys or cloud credentials"
+      value: '\b(?:id_rsa|id_dsa|id_ed25519|id_ecdsa)\b(?!\.pub)|\b(?:\.aws/credentials|\.kube/config|\.docker/config\.json|\.netrc|known_hosts)\b|/etc/(?:passwd|shadow|ssl/private)|/proc/self/environ|\b\.env(?:\.local|\.production|\.secret)?\b(?![/a-zA-Z])'
+      description: "Sensitive credential file referenced in tool description — private keys or cloud credentials (v2: dropped mcp.json + .aws/config — common non-secret config files that appear in ordinary git/edit operations; the exfil case is still caught by the <IMPORTANT>-tag and read/send-directive layers. id_rsa excludes the .pub public key.)"
 
     # Layer 4 — Concealment directive combined with "implementation detail"
     # justification. This is the exact pattern Invariant Labs documented for

package/rules/tool-poisoning/ATR-2026-00531-praisonai-unauthenticated-agent-api.yaml

@@ -16,7 +16,7 @@ author: "ATR Community"
 date: "2026/05/20"
 schema_version: "0.1"
 detection_tier: pattern
-maturity: experimental
+maturity: test
 severity: critical
 
 references:

package/rules/tool-poisoning/ATR-2026-00532-apache-doris-mcp-sql-injection.yaml

@@ -14,7 +14,7 @@ author: "ATR Community"
 date: "2026/05/20"
 schema_version: "0.1"
 detection_tier: pattern
-maturity: experimental
+maturity: test
 severity: critical
 
 references:

package/rules/tool-poisoning/ATR-2026-00533-apache-pinot-mcp-unauthenticated-takeover.yaml

@@ -15,7 +15,7 @@ author: "ATR Community"
 date: "2026/05/20"
 schema_version: "0.1"
 detection_tier: pattern
-maturity: experimental
+maturity: test
 severity: critical
 
 references:

package/rules/tool-poisoning/ATR-2026-00534-alibaba-rds-mcp-unauthenticated-metadata-exfil.yaml

@@ -17,7 +17,7 @@ author: "ATR Community"
 date: "2026/05/20"
 schema_version: "0.1"
 detection_tier: pattern
-maturity: experimental
+maturity: test
 severity: high
 
 references:

package/rules/tool-poisoning/ATR-2026-00536-nginx-ui-mcp-unauthenticated-command-execution.yaml

@@ -18,7 +18,7 @@ author: "ATR Community"
 date: "2026/05/20"
 schema_version: "0.1"
 detection_tier: pattern
-maturity: experimental
+maturity: test
 severity: critical
 
 references:

package/rules/tool-poisoning/ATR-2026-00561-fastmcp-vulnerable-to-windows-command-in.yaml

@@ -9,7 +9,7 @@ author: ATR Community (GHSA sync)
 date: 2026/06/01
 schema_version: '0.1'
 detection_tier: pattern
-maturity: experimental
+maturity: test
 severity: critical
 references:
   cve:

package/rules/tool-poisoning/ATR-2026-00567-mcp-stdio-config-command-injection.yaml

@@ -7,7 +7,7 @@ author: ATR Community
 date: 2026/06/02
 schema_version: '0.1'
 detection_tier: pattern
-maturity: experimental
+maturity: test
 severity: high
 references:
   cve:

package/rules/tool-poisoning/ATR-2026-00568-agent-ssrf-cloud-metadata-file-inclusion.yaml

@@ -7,7 +7,7 @@ author: ATR Community
 date: 2026/06/02
 schema_version: '0.1'
 detection_tier: pattern
-maturity: experimental
+maturity: test
 severity: high
 references:
   cve:

package/rules/tool-poisoning/ATR-2026-00572-symjack-symlink-config-redirection.yaml

@@ -24,7 +24,7 @@ author: "ATR Community"
 date: "2026/06/03"
 schema_version: "0.1"
 detection_tier: pattern
-maturity: experimental
+maturity: test
 severity: critical
 references:
   owasp_llm:

package/rules/tool-poisoning/ATR-2026-00581-mcp-tool-rug-pull-post-approval-redefinition.yaml

@@ -29,6 +29,7 @@ references:
   mitre_atlas:
   - "AML.T0053 - AI Agent Tool Invocation"
   - "AML.T0051.001 - Indirect"
+  - "AML.T0104 - Publish Poisoned AI Agent Tool"
   vulnerablemcp_id:
     - tool-poisoning-rce-rug-pull
   external:

package/rules/tool-poisoning/ATR-2026-01932-shadow-undeclared-mcp-server-registration.yaml

@@ -29,6 +29,7 @@ references:
     - "ASI09:2026 - Identity Spoofing and Impersonation"
   mitre_atlas:
     - "AML.T0010 - AI Supply Chain Compromise"
+    - "AML.T0104 - Publish Poisoned AI Agent Tool"
   mitre_attack:
     - "T1195.002 - Compromise Software Supply Chain"
     - "T1036 - Masquerading"

package/rules/tool-poisoning/ATR-2026-01935-litellm-custom-code-sandbox-escape-cve-2026-40217.yaml

@@ -0,0 +1,161 @@
+title: "LiteLLM Custom-Code Guardrail Sandbox Escape (CVE-2026-40217)"
+id: ATR-2026-01935
+rule_version: 1
+status: draft
+description: >
+  Detects CVE-2026-40217 (CWE-94/CWE-265): LiteLLM's custom-code guardrail
+  test/compile path /guardrails/test_custom_code evaluates caller-supplied
+  Python in an unsafe sandbox that can be escaped via bytecode rewriting and
+  dunder-attribute traversal, yielding server-side code execution as the
+  LiteLLM proxy process. Affected through 2026-04-08 builds.
+
+  Detection covers:
+  (a) a request to the /guardrails/test_custom_code endpoint carrying Python
+      code-execution primitives (import os, subprocess, exec/eval/compile);
+  (b) sandbox-escape primitives (dunder traversal __subclasses__/__globals__/
+      __builtins__, code-object/bytecode rewriting) in a guardrail code body;
+  (c) explicit CVE-2026-40217 exploitation framing.
+
+  The detection target is custom guardrail code reaching the test endpoint
+  with escape primitives — the exact sandbox-escape shape — caught before the
+  proxy compiles and runs it.
+author: "ATR Community"
+date: "2026/06/26"
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: critical
+
+references:
+  owasp_llm:
+    - "LLM05:2025 - Improper Output Handling"
+    - "LLM06:2025 - Excessive Agency"
+  owasp_agentic:
+    - "ASI05:2026 - Unexpected Code Execution"
+    - "ASI06:2026 - Tool Misuse"
+  mitre_atlas:
+    - "AML.T0049 - Exploit Public-Facing Application"
+  mitre_attack:
+    - "T1059.006 - Command and Scripting Interpreter: Python"
+  cve:
+    - "CVE-2026-40217"
+
+metadata_provenance:
+  mitre_atlas: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+
+compliance:
+  eu_ai_act:
+    - article: "15"
+      context: >
+        CVE-2026-40217 lets a caller escape the LiteLLM custom-code guardrail
+        sandbox and run code as the proxy; Article 15 cybersecurity
+        requirements mandate that AI guardrail code-evaluation paths refuse
+        sandbox-escape primitives.
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the code-execution technique (LiteLLM Custom-Code Guardrail Sandbox Escape (CVE-2026-40217))."
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: "MP.5.1"
+      context: >
+        Custom guardrail code carrying sandbox-escape primitives is an
+        adversarial input; MP.5.1 requires scanning /guardrails/test_custom_code
+        payloads for code-execution and dunder-traversal patterns.
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 is supported where this rule detects the code-execution technique (LiteLLM Custom-Code Guardrail Sandbox Escape (CVE-2026-40217))."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: >
+        Operational controls must detect guardrail code-evaluation payloads
+        carrying sandbox-escape primitives at the LiteLLM test endpoint before
+        the proxy compiles and runs them.
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the code-execution technique (LiteLLM Custom-Code Guardrail Sandbox Escape (CVE-2026-40217)) as a treatment control."
+      strength: secondary
+
+tags:
+  category: tool-poisoning
+  subcategory: sandbox-escape
+  scan_target: both
+  confidence: high
+  source: cve-disclosure
+  vendor_sources: litellm-cve-2026-40217
+
+agent_source:
+  type: llm_io
+  framework:
+    - litellm
+    - any
+  provider:
+    - any
+
+detection:
+  condition: any
+  false_positives:
+    - "Security advisory or PR text quoting the CVE-2026-40217 sandbox-escape payload."
+    - "A benign custom guardrail that only inspects request text and uses no os/subprocess/exec or dunder traversal."
+    - "Documentation describing the /guardrails endpoints without code-execution primitives."
+  conditions:
+    - field: content
+      operator: regex
+      value: '(?i)/guardrails/test_custom_code[\s\S]{0,400}(?:import\s+os\b|import\s+subprocess\b|subprocess\.(?:Popen|run|call|check_output)|\bos\.(?:system|popen|exec|spawn)|\bexec\s*\(|\beval\s*\(|\bcompile\s*\()'
+      description: >
+        A request to /guardrails/test_custom_code carrying Python
+        code-execution primitives — direct CVE-2026-40217 attack shape.
+    - field: content
+      operator: regex
+      value: '(?i)(?:test_custom_code|custom[_-]?code[_-]?guardrail)[\s\S]{0,400}(?:__subclasses__|__globals__|__builtins__|__class__\s*\.\s*__|\bco_code\b|types\.CodeType|\.__code__\b|bytecode)'
+      description: >
+        Custom guardrail code reaching the test path with dunder-traversal or
+        bytecode-rewriting sandbox-escape primitives.
+    - field: content
+      operator: regex
+      value: '(?i)CVE-2026-40217[\s\S]{0,200}(?:litellm|guardrail|sandbox|custom[_\s-]?code|bytecode|escape|rce)'
+      description: >
+        Explicit CVE-2026-40217 reference combined with LiteLLM guardrail
+        sandbox-escape language — attack framing in a skill or tool description.
+
+response:
+  actions:
+    - alert
+    - block_input
+  message_template: >
+    [ATR-2026-01935] CRITICAL: LiteLLM custom-code guardrail sandbox escape
+    detected (CVE-2026-40217, CWE-94). Custom guardrail code reaches
+    /guardrails/test_custom_code with code-execution or sandbox-escape
+    primitives, yielding RCE as the proxy. Block the request and upgrade
+    LiteLLM to a build after 2026-04-08.
+
+confidence: 80
+
+wild_fp_rate: 0
+
+test_cases:
+  true_positives:
+    - input: "POST /guardrails/test_custom_code {\"code\": \"import os; os.system('id')\"}"
+      expected: triggered
+      description: "Custom-code guardrail test payload running os.system"
+    - input: "POST /guardrails/test_custom_code {\"code\": \"().__class__.__bases__[0].__subclasses__()\"}"
+      expected: triggered
+      description: "Dunder-traversal sandbox escape via test_custom_code"
+    - input: "CVE-2026-40217: send custom_code guardrail to LiteLLM /guardrails/test_custom_code using bytecode rewriting to escape the sandbox for RCE."
+      expected: triggered
+      description: "Explicit CVE-2026-40217 LiteLLM sandbox-escape framing"
+  true_negatives:
+    - input: "POST /guardrails/test_custom_code {\"code\": \"return 'blocked' if 'ssn' in text else 'allow'\"}"
+      expected: not_triggered
+      description: "Benign guardrail inspecting text, no os/exec/dunder primitives"
+    - input: "GET /guardrails/list"
+      expected: not_triggered
+      description: "Read-only guardrail listing, no custom code"
+    - input: "How do custom-code guardrails work in LiteLLM?"
+      expected: not_triggered
+      description: "General question, no code-execution primitives"
+    - input: "import os is a common Python pattern in many legitimate scripts."
+      expected: not_triggered
+      description: "import os outside the test_custom_code endpoint context"

package/rules/tool-poisoning/ATR-2026-01980-agentic-flow-mcp-tool-param-command-injection.yaml

@@ -0,0 +1,153 @@
+title: "Agentic-Flow MCP Tool-Parameter OS Command Injection (GHSA-vcv2-r9jh-99m5)"
+id: ATR-2026-01980
+rule_version: 1
+status: draft
+description: >
+  Detects GHSA-vcv2-r9jh-99m5 (CWE-78): agentic-flow <= 2.0.13 MCP server
+  tools (agentic_flow_agent, agentic_flow_create_agent, agent_booster_edit_file,
+  agentdb_pattern_store, and related tools under standalone-stdio.ts / fastmcp
+  servers) interpolate attacker-influenceable parameters (agent, task, name,
+  language, agentdb arguments) directly into shell strings passed to
+  execSync(). A parameter value that breaks out of the surrounding
+  double-quoted argument executes arbitrary OS commands with the privileges
+  of the MCP server process.
+
+  Detection covers:
+  (a) an agentic-flow tool-call argument value containing a double-quote
+      breakout followed by shell command chaining (`; `, backticks, or
+      `$(...)`) — the exact PoC shape from the advisory
+      (task = `x"; touch /tmp/INJECTED; id > /tmp/rce.txt; echo "`);
+  (b) the resulting interpolated `npx ... agentic-flow --agent/--task`
+      command string itself carrying injected shell metacharacters;
+  (c) explicit GHSA-vcv2-r9jh-99m5 exploitation framing.
+
+  The detection target is the request shape — a quote-breakout + command
+  chain inside an agentic-flow tool argument — which is the exact
+  command-injection primitive, caught before execSync() hands it to
+  /bin/sh -c. Bound to the agentic-flow tool surface so a benign
+  shell-looking string elsewhere does not fire.
+author: "ATR Community"
+date: "2026/07/04"
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: critical
+
+references:
+  owasp_llm:
+    - "LLM06:2025 - Excessive Agency"
+  owasp_agentic:
+    - "ASI06:2026 - Tool Misuse"
+  mitre_atlas:
+    - "AML.T0053 - LLM Plugin Compromise"
+  mitre_attack:
+    - "T1059 - Command and Scripting Interpreter"
+  ghsa:
+    - "GHSA-vcv2-r9jh-99m5"
+
+metadata_provenance:
+  mitre_atlas: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+
+compliance:
+  eu_ai_act:
+    - { article: "15", context: "Article 15 cybersecurity — runtime detection of agentic-flow MCP tool-parameter OS command injection.", strength: primary }
+    - { article: "9",  context: "Article 9 risk management — runtime risk-treatment control for agentic-flow MCP tool-parameter OS command injection.", strength: secondary }
+  nist_ai_rmf:
+    - { subcategory: "MP.5.1", context: "MAP 5.1 — adversarial input characterised/detected for agentic-flow MCP tool-parameter OS command injection.", strength: primary }
+    - { subcategory: "MG.3.2", context: "MANAGE 3.2 — runtime monitoring control for agentic-flow MCP tool-parameter OS command injection.", strength: secondary }
+  iso_42001:
+    - { clause: "8.1", context: "Clause 8.1 operational control — detection of agentic-flow MCP tool-parameter OS command injection payload.", strength: primary }
+    - { clause: "8.3", context: "Clause 8.3 AI risk treatment — runtime detection as treatment control.", strength: secondary }
+
+tags:
+  category: tool-poisoning
+  subcategory: command-injection
+  scan_target: mcp
+  confidence: high
+  source: ghsa-disclosure
+  vendor_sources: agentic-flow-ghsa-vcv2-r9jh-99m5
+
+agent_source:
+  type: tool_call
+  framework:
+    - agentic-flow
+    - any
+  provider:
+    - any
+
+detection:
+  condition: any
+  false_positives:
+    - "A tool_args value that legitimately contains a semicolon or backtick as literal text data (e.g. discussing shell syntax) without an adjacent quote-breakout shape."
+    - "Security advisory or PR text quoting the GHSA-vcv2-r9jh-99m5 payload for review purposes."
+    - "A benign agentic-flow agent/task value with no quote character or shell metacharacter."
+  conditions:
+    - field: tool_args
+      operator: regex
+      value: '(?i)\b(?:agent|task|name|language|agentdb)["\x27]?\s*[:=]\s*["\x27][^"\x27\n]{0,200}["\x27]\s*;\s*[\s\S]{0,120}\b(?:touch|rm|curl|wget|cat|id|nc|bash|sh|chmod|echo)\b'
+      description: >
+        agentic-flow tool argument (agent/task/name/language/agentdb) whose
+        value breaks out of its quote with `";` followed by a chained shell
+        command — the canonical GHSA-vcv2-r9jh-99m5 PoC shape.
+    - field: tool_args
+      operator: regex
+      value: '(?i)npx\s+--yes\s+agentic-flow[\s\S]{0,80}--(?:agent|task)\s+"[^"\n]{0,200}"\s*;\s*[\s\S]{0,120}\b(?:touch|rm|curl|wget|cat|id|nc|bash|sh|chmod)\b'
+      description: >
+        The interpolated `npx --yes agentic-flow --agent/--task` command
+        string itself carrying an injected chained shell command after the
+        closing quote — the post-interpolation execSync() payload.
+    - field: tool_args
+      operator: regex
+      value: '(?i)["\x27][^"\x27\n]{0,200}["\x27]\s*;[\s\S]{0,80}`[^`\n]{0,120}`|["\x27][^"\x27\n]{0,200}["\x27]\s*;[\s\S]{0,80}\$\([^)\n]{0,120}\)'
+      description: >
+        Quote-breakout followed by a backtick or $() command substitution
+        inside an agentic-flow tool argument.
+    - field: content
+      operator: regex
+      value: '(?i)GHSA-vcv2-r9jh-99m5[\s\S]{0,200}(?:agentic-flow|execSync|command\s*inject|RCE)'
+      description: >
+        Explicit GHSA-vcv2-r9jh-99m5 reference combined with agentic-flow
+        command-injection language — attack framing in a skill or tool
+        description.
+
+response:
+  actions:
+    - alert
+    - block_tool
+  message_template: >
+    [ATR-2026-01980] CRITICAL: Agentic-Flow MCP tool-parameter OS command
+    injection detected (GHSA-vcv2-r9jh-99m5, CWE-78). A tool argument breaks
+    out of its shell quote and chains a command; agentic-flow <= 2.0.13
+    interpolates this into execSync() unsanitized. Block the tool call and
+    upgrade agentic-flow to >= 2.0.14.
+
+confidence: 85
+
+wild_fp_rate: 0
+
+test_cases:
+  true_positives:
+    - tool_args: 'task="x\"; touch /tmp/INJECTED; id > /tmp/rce.txt; echo \""'
+      expected: triggered
+      description: "Canonical PoC: task param quote-breakout chaining touch+id+echo"
+    - tool_args: 'npx --yes agentic-flow --agent "coder" --task "x"; touch /tmp/INJECTED; id > /tmp/rce.txt; echo ""'
+      expected: triggered
+      description: "Post-interpolation execSync() command string with injected chain"
+    - tool_description: "Exploiting GHSA-vcv2-r9jh-99m5 in agentic-flow: craft a task value that breaks the execSync quoting for command injection RCE."
+      expected: triggered
+      description: "Explicit GHSA-vcv2-r9jh-99m5 agentic-flow exploitation framing"
+  true_negatives:
+    - tool_args: 'agent="coder", task="Refactor the login handler to use async/await"'
+      expected: not_triggered
+      description: "Legitimate agentic-flow task description, no quote-breakout"
+    - content: "How do I configure the agentic-flow MCP server's agent and task parameters?"
+      expected: not_triggered
+      description: "Benign question about agentic-flow configuration"
+    - tool_args: 'name="release-notes", language="typescript"'
+      expected: not_triggered
+      description: "Normal name/language params with no shell metacharacters"
+    - tool_args: 'agentdb_pattern_search query="find all functions that touch the user; audit them"'
+      expected: not_triggered
+      description: "Benign text containing the word touch and a semicolon in natural language, no quote-breakout or dangerous command token"