agent-threat-rules 4.0.0 → 4.1.5

package/rules/tool-poisoning/ATR-2026-01982-dbt-mcp-node-selection-argument-injection.yaml

@@ -1,72 +1,61 @@
-title: "dbt-mcp node_selection/resource_type Argument Injection (CVE-2026-44968)"
+title: dbt-mcp node_selection/resource_type Argument Injection (CVE-2026-44968)
 id: ATR-2026-01982
 rule_version: 1
 status: experimental
-description: >
-  Detects CVE-2026-44968 / GHSA-xpww-f6pm-cfhq (CWE-88): dbt-mcp's
-  _run_dbt_command() in src/dbt_mcp/dbt_cli/tools.py appends the
-  MCP-client-supplied node_selection string (split on space) and
-  resource_type JSON array verbatim to the dbt subprocess argv without
-  validating that tokens don't begin with a dash. Because Popen is called
-  with shell=False, shell metacharacters are inert, but an attacker can still
-  inject dbt global flags — --profiles-dir, --project-dir, --target,
-  --profile — as independent argv elements on the build/compile/run/test/
-  clone/list/get_node_details_dev tools, redirecting dbt's configuration,
-  project root, or execution target (demonstrated PoC: node_selection =
-  "my_model --profiles-dir /tmp/evil" loads an attacker-controlled
-  profiles.yml and writes to an attacker-chosen database path).
-
-  Detection covers:
-  (a) a node_selection value containing an injected dbt global flag token
+description: |
+  Detects CVE-2026-44968 / GHSA-xpww-f6pm-cfhq (CWE-88): dbt-mcp's _run_dbt_command() in src/dbt_mcp/dbt_cli/tools.py appends the MCP-client-supplied node_selection string (split on space) and resource_type JSON array verbatim to the dbt subprocess argv without validating that tokens don't begin with a dash. Because Popen is called with shell=False, shell metacharacters are inert, but an attacker can still inject dbt global flags — --profiles-dir, --project-dir, --target, --profile — as independent argv elements on the build/compile/run/test/ clone/list/get_node_details_dev tools, redirecting dbt's configuration, project root, or execution target (demonstrated PoC: node_selection = "my_model --profiles-dir /tmp/evil" loads an attacker-controlled profiles.yml and writes to an attacker-chosen database path).
+  Detection covers: (a) a node_selection value containing an injected dbt global flag token
       after the legitimate selector (space-separated, so the flag rides
       along as an extra "word");
   (b) a resource_type JSON array containing an injected flag token as an
       array element instead of a valid resource type;
   (c) explicit CVE-2026-44968 / GHSA-xpww-f6pm-cfhq exploitation framing.
-
-  The detection target is the request shape — a dash-prefixed dbt global
-  flag riding inside a selector/resource-type value that should only ever
-  contain a selector or resource-type token — which is the exact argument-
-  injection primitive, caught before _run_dbt_command() extends argv. Bound
-  to the dbt-mcp tool surface (node_selection/resource_type params) so a
-  benign selector string elsewhere does not fire.
-author: "ATR Community"
-date: "2026/07/04"
-schema_version: "0.1"
+  The detection target is the request shape — a dash-prefixed dbt global flag riding inside a selector/resource-type value that should only ever contain a selector or resource-type token — which is the exact argument- injection primitive, caught before _run_dbt_command() extends argv. Bound to the dbt-mcp tool surface (node_selection/resource_type params) so a benign selector string elsewhere does not fire.
+author: ATR Community
+date: 2026/07/04
+schema_version: '0.1'
 detection_tier: pattern
 maturity: test
 severity: medium
-
 references:
   owasp_llm:
-    - "LLM06:2025"
+    - LLM06:2025
   owasp_agentic:
-    - "ASI06:2026"
+    - ASI06:2026
   mitre_atlas:
-    - "AML.T0053 - LLM Plugin Compromise"
+    - AML.T0053 - LLM Plugin Compromise
   mitre_attack:
-    - "T1059 - Command and Scripting Interpreter"
+    - T1059 - Command and Scripting Interpreter
   cve:
-    - "CVE-2026-44968"
+    - CVE-2026-44968
   ghsa:
-    - "GHSA-xpww-f6pm-cfhq"
-
+    - GHSA-xpww-f6pm-cfhq
 metadata_provenance:
   mitre_atlas: human-reviewed
   owasp_llm: human-reviewed
   owasp_agentic: human-reviewed
-
 compliance:
   eu_ai_act:
-    - { article: "15", context: "Article 15 cybersecurity — runtime detection of dbt-mcp node_selection/resource_type argument injection.", strength: primary }
-    - { article: "9",  context: "Article 9 risk management — runtime risk-treatment control for dbt-mcp node_selection/resource_type argument injection.", strength: secondary }
+    - article: '15'
+      context: Article 15 cybersecurity — runtime detection of dbt-mcp node_selection/resource_type argument injection.
+      strength: primary
+    - article: '9'
+      context: Article 9 risk management — runtime risk-treatment control for dbt-mcp node_selection/resource_type argument injection.
+      strength: secondary
   nist_ai_rmf:
-    - { subcategory: "MP.5.1", context: "MAP 5.1 — adversarial input characterised/detected for dbt-mcp node_selection/resource_type argument injection.", strength: primary }
-    - { subcategory: "MG.3.2", context: "MANAGE 3.2 — runtime monitoring control for dbt-mcp node_selection/resource_type argument injection.", strength: secondary }
+    - subcategory: MP.5.1
+      context: MAP 5.1 — adversarial input characterised/detected for dbt-mcp node_selection/resource_type argument injection.
+      strength: primary
+    - subcategory: MG.3.2
+      context: MANAGE 3.2 — runtime monitoring control for dbt-mcp node_selection/resource_type argument injection.
+      strength: secondary
   iso_42001:
-    - { clause: "8.1", context: "Clause 8.1 operational control — detection of dbt-mcp node_selection/resource_type argument injection payload.", strength: primary }
-    - { clause: "8.3", context: "Clause 8.3 AI risk treatment — runtime detection as treatment control.", strength: secondary }
-
+    - clause: '8.1'
+      context: Clause 8.1 operational control — detection of dbt-mcp node_selection/resource_type argument injection payload.
+      strength: primary
+    - clause: '8.3'
+      context: Clause 8.3 AI risk treatment — runtime detection as treatment control.
+      strength: secondary
 tags:
   category: tool-poisoning
   subcategory: argument-injection
@@ -74,7 +63,6 @@ tags:
   confidence: high
   source: cve-disclosure
   vendor_sources: dbt-mcp-cve-2026-44968
-
 agent_source:
   type: tool_call
   framework:
@@ -82,78 +70,37 @@ agent_source:
     - any
   provider:
     - any
-
 detection:
   condition: any
   false_positives:
-    - "A node_selection value that legitimately contains a dbt selector method using a colon (tag:, config:) rather than a dash-prefixed flag."
-    - "Security advisory or PR text quoting the CVE-2026-44968 / GHSA-xpww-f6pm-cfhq payload for review purposes."
-    - "A resource_type array containing only valid dbt resource type names (model, test, snapshot, source, etc.) with no injected flag."
+    - A node_selection value that legitimately contains a dbt selector method using a colon (tag:, config:) rather than a dash-prefixed flag.
+    - Security advisory or PR text quoting the CVE-2026-44968 / GHSA-xpww-f6pm-cfhq payload for review purposes.
+    - A resource_type array containing only valid dbt resource type names (model, test, snapshot, source, etc.) with no injected flag.
   conditions:
     - field: tool_args
       operator: regex
-      value: '(?i)\bnode_selection["\x27]?\s*[:=]\s*["\x27][^"\x27\n]{0,200}\s(?:--profiles-dir|--project-dir|--target|--profile)\b'
-      description: >
-        node_selection value whose space-separated tokens include an
-        injected dbt global flag (--profiles-dir/--project-dir/--target/
-        --profile) after the legitimate selector — CVE-2026-44968 Vector 1.
+      value: (?i)\bnode_selection["\x27]?\s*[:=]\s*["\x27][^"\x27\n]{0,200}\s(?:--profiles-dir|--project-dir|--target|--profile)\b
+      description: |
+        node_selection value whose space-separated tokens include an injected dbt global flag (--profiles-dir/--project-dir/--target/ --profile) after the legitimate selector — CVE-2026-44968 Vector 1.
     - field: tool_args
       operator: regex
-      value: '(?i)\bresource_type["\x27]?\s*[:=]\s*\[[^\]\n]{0,200}["\x27](?:--profiles-dir|--project-dir|--target|--profile)["\x27][^\]\n]{0,200}\]'
-      description: >
-        resource_type JSON array containing an injected dbt global flag
-        token as an array element instead of a valid resource type —
-        CVE-2026-44968 Vector 2.
+      value: (?i)\bresource_type["\x27]?\s*[:=]\s*\[[^\]\n]{0,200}["\x27](?:--profiles-dir|--project-dir|--target|--profile)["\x27][^\]\n]{0,200}\]
+      description: |
+        resource_type JSON array containing an injected dbt global flag token as an array element instead of a valid resource type — CVE-2026-44968 Vector 2.
     - field: tool_args
       operator: regex
-      value: '(?i)--(?:profiles-dir|project-dir|target|profile)\s+["\x27]?/tmp/[^"\x27\s\n]{0,80}["\x27]?[\s\S]{0,120}\b(?:node_selection|resource_type|--select|--resource-type)\b'
-      description: >
-        An injected dbt global flag pointing at an attacker-controlled path
-        appearing alongside the vulnerable --select/--resource-type argv
-        construction.
+      value: (?i)--(?:profiles-dir|project-dir|target|profile)\s+["\x27]?/tmp/[^"\x27\s\n]{0,80}["\x27]?[\s\S]{0,120}\b(?:node_selection|resource_type|--select|--resource-type)\b
+      description: |
+        An injected dbt global flag pointing at an attacker-controlled path appearing alongside the vulnerable --select/--resource-type argv construction.
     - field: content
       operator: regex
-      value: '(?i)(?:CVE-2026-44968|GHSA-xpww-f6pm-cfhq)[\s\S]{0,200}(?:dbt-mcp|node_selection|resource_type|profiles-dir|argument\s*inject)'
-      description: >
-        Explicit CVE-2026-44968 / GHSA-xpww-f6pm-cfhq reference combined with
-        dbt-mcp argument-injection language — attack framing in a skill or
-        tool description.
-
+      value: (?i)(?:CVE-2026-44968|GHSA-xpww-f6pm-cfhq)[\s\S]{0,200}(?:dbt-mcp|node_selection|resource_type|profiles-dir|argument\s*inject)
+      description: |
+        Explicit CVE-2026-44968 / GHSA-xpww-f6pm-cfhq reference combined with dbt-mcp argument-injection language — attack framing in a skill or tool description.
 response:
   actions:
     - alert
     - block_tool
-  message_template: >
-    [ATR-2026-01982] MEDIUM: dbt-mcp node_selection/resource_type argument
-    injection detected (CVE-2026-44968, CWE-88). A tool argument injects a
-    dbt global flag (--profiles-dir/--project-dir/--target) as an argv
-    element; dbt-mcp before 1.17.1 appends this to the dbt subprocess
-    unsanitized. Block the tool call and upgrade dbt-mcp to >= 1.17.1.
-
+  message_template: |
+    [ATR-2026-01982] MEDIUM: dbt-mcp node_selection/resource_type argument injection detected (CVE-2026-44968, CWE-88). A tool argument injects a dbt global flag (--profiles-dir/--project-dir/--target) as an argv element; dbt-mcp before 1.17.1 appends this to the dbt subprocess unsanitized. Block the tool call and upgrade dbt-mcp to >= 1.17.1.
 confidence: 80
-
-
-test_cases:
-  true_positives:
-    - tool_args: 'node_selection="my_first_model --profiles-dir /tmp/evil-profiles"'
-      expected: triggered
-      description: "PoC Vector 1: node_selection injects --profiles-dir pointing at attacker path"
-    - tool_args: 'resource_type=["model", "--profiles-dir", "/tmp/evil-profiles"]'
-      expected: triggered
-      description: "PoC Vector 2: resource_type array smuggles --profiles-dir as an element"
-    - tool_description: "Exploiting CVE-2026-44968 (GHSA-xpww-f6pm-cfhq) in dbt-mcp: craft node_selection to inject --profiles-dir for argument injection against the dbt CLI."
-      expected: triggered
-      description: "Explicit CVE-2026-44968 dbt-mcp exploitation framing"
-  true_negatives:
-    - tool_args: 'node_selection="my_first_model+ tag:nightly"'
-      expected: not_triggered
-      description: "Legitimate dbt selector syntax with plus-operator and tag: method, no injected flag"
-    - tool_args: 'resource_type=["model", "test", "source"]'
-      expected: not_triggered
-      description: "Valid resource_type array with only real dbt resource type names"
-    - content: "How do I filter dbt models using node_selection in the dbt-mcp run tool?"
-      expected: not_triggered
-      description: "Benign question about dbt-mcp node_selection usage"
-    - tool_args: 'node_selection="staging.orders"'
-      expected: not_triggered
-      description: "Simple model selector, no flags, read-only compile intent"

package/rules/tool-poisoning/ATR-2026-01983-mcp-for-stata-log-file-name-command-injection.yaml

@@ -1,76 +1,58 @@
-title: "MCP-for-Stata: Command Injection via log_file_name Parameter (CVE-2026-47708)"
+title: 'MCP-for-Stata: Command Injection via log_file_name Parameter (CVE-2026-47708)'
 id: ATR-2026-01983
 rule_version: 1
 status: experimental
-description: >
-  Detects CVE-2026-47708 (CVSS critical, CWE-77): the `log_file_name` (aka
-  `log_name`) parameter accepted by the `stata_do` MCP tool / CLI is
-  interpolated directly into a Stata `log using "<log_file>", ...` command
-  string without sanitization. GuardValidator only scans do-file content, not
-  this wrapper parameter. An attacker breaks out of the quoted log-path
-  string with a quote or newline and appends a dangerous Stata command
-  (`shell`, `python`, `erase`, `winexec`, or `!` shell-escape), achieving
-  remote code execution, or supplies `../` path-traversal segments in
-  log_name to write arbitrary files outside the log directory.
-
-  Detection covers:
-  (a) a stata_do tool call whose log_file_name/log_name value contains a
+description: |
+  Detects CVE-2026-47708 (CVSS critical, CWE-77): the `log_file_name` (aka `log_name`) parameter accepted by the `stata_do` MCP tool / CLI is interpolated directly into a Stata `log using "<log_file>", ...` command string without sanitization. GuardValidator only scans do-file content, not this wrapper parameter. An attacker breaks out of the quoted log-path string with a quote or newline and appends a dangerous Stata command (`shell`, `python`, `erase`, `winexec`, or `!` shell-escape), achieving remote code execution, or supplies `../` path-traversal segments in log_name to write arbitrary files outside the log directory.
+  Detection covers: (a) a stata_do tool call whose log_file_name/log_name value contains a
       quote/newline breakout followed by a dangerous Stata command token;
-  (b) a log_file_name/log_name value containing path-traversal segments;
-  (c) explicit CVE-2026-47708 exploitation framing referencing the
+  (b) a log_file_name/log_name value containing path-traversal segments; (c) explicit CVE-2026-47708 exploitation framing referencing the
       log_file_name / stata_do injection.
 
-  The detection target is the request shape — a stata_do log_file_name
-  parameter carrying a string-breakout plus command injection or path
-  traversal — the exact CVE-2026-47708 primitive, caught before the
-  wrapper builds the Stata command string.
-author: "ATR Community"
-date: "2026/07/04"
-schema_version: "0.1"
+  The detection target is the request shape — a stata_do log_file_name parameter carrying a string-breakout plus command injection or path traversal — the exact CVE-2026-47708 primitive, caught before the wrapper builds the Stata command string.
+author: ATR Community
+date: 2026/07/04
+schema_version: '0.1'
 detection_tier: pattern
 maturity: test
 severity: critical
-
 references:
   owasp_llm:
-    - "LLM06:2025"
+    - LLM06:2025
   owasp_agentic:
-    - "ASI06:2026"
+    - ASI06:2026
   mitre_atlas:
-    - "AML.T0053 - LLM Plugin Compromise"
+    - AML.T0053 - LLM Plugin Compromise
   mitre_attack:
-    - "T1059 - Command and Scripting Interpreter"
+    - T1059 - Command and Scripting Interpreter
   cve:
-    - "CVE-2026-47708"
-
+    - CVE-2026-47708
 metadata_provenance:
   mitre_atlas: human-reviewed
   owasp_llm: human-reviewed
   owasp_agentic: human-reviewed
-
 compliance:
   eu_ai_act:
-    - article: "15"
-      context: "Article 15 cybersecurity — runtime detection of MCP-for-Stata log_file_name command injection (CVE-2026-47708)."
+    - article: '15'
+      context: Article 15 cybersecurity — runtime detection of MCP-for-Stata log_file_name command injection (CVE-2026-47708).
       strength: primary
-    - article: "9"
-      context: "Article 9 risk management — runtime risk-treatment control for MCP-for-Stata log_file_name command injection (CVE-2026-47708)."
+    - article: '9'
+      context: Article 9 risk management — runtime risk-treatment control for MCP-for-Stata log_file_name command injection (CVE-2026-47708).
       strength: secondary
   nist_ai_rmf:
-    - subcategory: "MP.5.1"
-      context: "MAP 5.1 — adversarial input characterised/detected for MCP-for-Stata log_file_name command injection (CVE-2026-47708)."
+    - subcategory: MP.5.1
+      context: MAP 5.1 — adversarial input characterised/detected for MCP-for-Stata log_file_name command injection (CVE-2026-47708).
       strength: primary
-    - subcategory: "MG.3.2"
-      context: "MANAGE 3.2 — runtime monitoring control for MCP-for-Stata log_file_name command injection (CVE-2026-47708)."
+    - subcategory: MG.3.2
+      context: MANAGE 3.2 — runtime monitoring control for MCP-for-Stata log_file_name command injection (CVE-2026-47708).
       strength: secondary
   iso_42001:
-    - clause: "8.1"
-      context: "Clause 8.1 operational control — detection of MCP-for-Stata log_file_name command injection payload."
+    - clause: '8.1'
+      context: Clause 8.1 operational control — detection of MCP-for-Stata log_file_name command injection payload.
       strength: primary
-    - clause: "8.3"
-      context: "Clause 8.3 AI risk treatment — runtime detection as treatment control."
+    - clause: '8.3'
+      context: Clause 8.3 AI risk treatment — runtime detection as treatment control.
       strength: secondary
-
 tags:
   category: tool-poisoning
   subcategory: mcp-command-injection
@@ -78,92 +60,43 @@ tags:
   confidence: high
   source: cve-disclosure
   vendor_sources: mcp-for-stata-cve-2026-47708
-
 agent_source:
   type: tool_call
   framework:
     - any
   provider:
     - any
-
 detection:
   condition: any
   false_positives:
-    - "A log_file_name value that legitimately contains a single quote as part of a project naming convention but no command token follows."
-    - "Security advisory or PR text quoting the CVE-2026-47708 payload."
-    - "A stata_do call with a plain alphanumeric log_file_name and no quote/newline breakout."
+    - A log_file_name value that legitimately contains a single quote as part of a project naming convention but no command token follows.
+    - Security advisory or PR text quoting the CVE-2026-47708 payload.
+    - A stata_do call with a plain alphanumeric log_file_name and no quote/newline breakout.
   conditions:
     - field: tool_args
       operator: regex
-      value: '(?i)\b(?:log_file_name|log_name)\b["\x27]?\s*[:=]\s*["\x27][\s\S]{0,80}["\x27][\s\S]{0,40}(?:\bshell\b|\bpython\b|\berase\b|\bwinexec\b|(?<![\w=])!(?!=))'
-      description: >
-        A stata_do log_file_name/log_name parameter value that breaks out of
-        its quoted string and is followed by a dangerous Stata command token
-        (shell / python / erase / winexec / ! shell-escape) — the
-        CVE-2026-47708 command-injection breakout shape.
+      value: (?i)\b(?:log_file_name|log_name)\b["\x27]?\s*[:=]\s*["\x27][\s\S]{0,80}["\x27][\s\S]{0,40}(?:\bshell\b|\bpython\b|\berase\b|\bwinexec\b|(?<![\w=])!(?!=))
+      description: |
+        A stata_do log_file_name/log_name parameter value that breaks out of its quoted string and is followed by a dangerous Stata command token (shell / python / erase / winexec / ! shell-escape) — the CVE-2026-47708 command-injection breakout shape.
     - field: tool_args
       operator: regex
-      value: '(?i)\blog\s+using\s+["\x27][\s\S]{0,120}["\x27][\s\S]{0,40}(?:\bshell\b|\bpython\b|\berase\b|\bwinexec\b)\b'
-      description: >
-        A generated Stata `log using "<path>", ...` command string where the
-        interpolated log path breaks out and chains into a dangerous Stata
-        command — the exact string the vulnerable generate_log_command
-        produces once log_name is attacker-controlled.
+      value: (?i)\blog\s+using\s+["\x27][\s\S]{0,120}["\x27][\s\S]{0,40}(?:\bshell\b|\bpython\b|\berase\b|\bwinexec\b)\b
+      description: |
+        A generated Stata `log using "<path>", ...` command string where the interpolated log path breaks out and chains into a dangerous Stata command — the exact string the vulnerable generate_log_command produces once log_name is attacker-controlled.
     - field: tool_args
       operator: regex
-      value: '(?i)\b(?:log_file_name|log_name)\b["\x27]?\s*[:=]\s*["\x27][\s\S]{0,20}(?:\.\.[\\/]){2,}'
-      description: >
-        A stata_do log_file_name/log_name parameter containing repeated
-        path-traversal segments (../) — arbitrary file write outside the
-        intended log directory.
+      value: (?i)\b(?:log_file_name|log_name)\b["\x27]?\s*[:=]\s*["\x27][\s\S]{0,20}(?:\.\.[\\/]){2,}
+      description: |
+        A stata_do log_file_name/log_name parameter containing repeated path-traversal segments (../) — arbitrary file write outside the intended log directory.
     - field: tool_args
       operator: regex
-      value: '(?i)CVE-2026-47708[\s\S]{0,200}(?:log_file_name|log_name|stata_do|GuardValidator)'
-      description: >
-        Explicit CVE-2026-47708 reference combined with the vulnerable
-        stata_do log_file_name/log_name parameter or GuardValidator guard —
-        attack framing in a skill or tool description.
-
+      value: (?i)CVE-2026-47708[\s\S]{0,200}(?:log_file_name|log_name|stata_do|GuardValidator)
+      description: |
+        Explicit CVE-2026-47708 reference combined with the vulnerable stata_do log_file_name/log_name parameter or GuardValidator guard — attack framing in a skill or tool description.
 response:
   actions:
     - alert
     - block_tool
-  message_template: >
-    [ATR-2026-01983] CRITICAL: MCP-for-Stata log_file_name command injection
-    detected (CVE-2026-47708, CWE-77). The stata_do log_file_name/log_name
-    parameter breaks out of its quoted Stata command string and injects a
-    dangerous command (shell/python/erase/winexec) or performs path
-    traversal. GuardValidator only scans do-file content, not this
-    parameter. Block the tool call and apply allowlist validation
-    (alphanumeric/underscore/dot/hyphen only) to log_name.
-
+  message_template: |
+    [ATR-2026-01983] CRITICAL: MCP-for-Stata log_file_name command injection detected (CVE-2026-47708, CWE-77). The stata_do log_file_name/log_name parameter breaks out of its quoted Stata command string and injects a dangerous command (shell/python/erase/winexec) or performs path traversal. GuardValidator only scans do-file content, not this parameter. Block the tool call and apply allowlist validation (alphanumeric/underscore/dot/hyphen only) to log_name.
 confidence: 82
-
-
-test_cases:
-  true_positives:
-    - tool_args: "stata_do {\"dofile_path\": \"test.do\", \"log_file_name\": \"'; shell echo pwned > /tmp/pwned.txt; '\"}"
-      expected: triggered
-      description: "CVE-2026-47708 PoC — log_file_name breaks out of quoted string and injects a shell command"
-    - tool_args: 'log using "/var/log/stata/x", replace text name(text_log) shell rm -rf ~'
-      expected: triggered
-      description: "Generated Stata log command with breakout chaining into a shell command"
-    - tool_args: 'log_file_name: "../../../../etc/cron.d/pwned"'
-      expected: triggered
-      description: "log_file_name path traversal to write outside the intended log directory"
-    - tool_args: "Exploiting CVE-2026-47708 in mcp-for-stata: craft a malicious log_file_name to break out of the quoted log using command and reach GuardValidator-unchecked stata_do."
-      expected: triggered
-      description: "Explicit CVE-2026-47708 mcp-for-stata exploitation framing"
-  true_negatives:
-    - tool_args: 'stata_do {"dofile_path": "analysis.do", "log_file_name": "session_2026_07_04"}'
-      expected: not_triggered
-      description: "Legitimate stata_do call with a plain alphanumeric log_file_name"
-    - tool_args: 'log using "/var/log/stata/session_2026_07_04.log", replace text name(text_log)'
-      expected: not_triggered
-      description: "Legitimate generated log using command with no breakout or injected command"
-    - tool_args: "How do I set a custom log_file_name when calling stata_do?"
-      expected: not_triggered
-      description: "General question about the log_file_name parameter, not an attack payload"
-    - tool_args: 'stata_do {"dofile_path": "regress.do", "log_name": "project-alpha_v2"}'
-      expected: not_triggered
-      description: "Read-only-style legitimate call with hyphenated project log name, no quote breakout"