Option-Flag Smuggling in an LLM-Controlled Tool Parameter

Detects a tool parameter that should carry DATA -- a search pattern, a filename, a hostname -- but instead carries an OPTION FLAG whose value names a program. The underlying CLI parses the value as an option rather than an operand and executes what it points at, so the agent never issues a shell command and no shell metacharacter ever appears. Derived from CVE-2026-48116 (AnythingLLM before 1.13.0): the filesystem-search-files agent skill passes its LLM-controlled `pattern` parameter to ripgrep as a positional argument with no `--` end-of-options separator. ripgrep treats any argument beginning with `-` as an option, so a pattern of `--pre=/bin/sh` turns the search tool into a script executor that runs the interpreter once per file it walks. WHY EXISTING COVERAGE MISSES THIS. Shell-metacharacter rules (ATR-2026-00111, ATR-2026-00066) key on `;`, `&&`, backticks, `$(`, pipes. A smuggled flag contains none of them: `--pre=/bin/sh` is a well-formed single token with no separator, no quoting, and no subshell. Measured against the engine before this rule was written, that exact parameter produced zero matches across the whole corpus. The invariant that does hold is positional: a value that is syntactically an option, sitting where the tool schema says an operand goes. GENERALISATION. The flag family is enumerated from the CLIs an agent actually drives, not from the one vendor: ripgrep --pre / --pre-glob, tar --to-command / --use-compress-program, wget --use-askpass, git --upload-pack / --receive-pack, sort --compress-program, mysql --pager, rsync --rsh, find -exec. Condition 2 generalises past the list entirely: ANY flag-shaped value whose payload is a path into a bin directory, appearing under a data-named JSON key. SSH IS OUT OF SCOPE ON PURPOSE. `-o ProxyCommand=` and its siblings belong to ATR-2026-02370, which owns the ssh/scp hostAlias surface and carries advisory prose about `-oProxyCommand=` as a declared true_negative. A condition here would have fired on that neighbour's benign set, which is a precision regression for it, so the ssh family was removed rather than duplicated. BOUNDARY, and how it was set. A value must both look like an option AND reach an executable: a named program under a bin directory, /tmp or /dev/shm, a .sh/.py/.pl script path, or a bare interpreter name. An earlier draft accepted any path-shaped value and any `--filter=`; measured against the 3,042-sample skills-sh corpus it fired three times, every hit on Turborepo documentation showing `--filter=./apps/*`. Both the `filter` flag and the loose path acceptance were removed for that reason. `--filter=blob:none` and `--output=/tmp/r.json` are also not matched, by construction. THE PARAMETER ANCHOR IS THE RULE (adversarial review, 2026-08-23). The first draft looked for the executor flag ANYWHERE in the content, dropping the positional invariant that the rest of this description argues is the only thing that holds. That version was blind on the 15,175-sample benign corpus and still fired on 16 of 20 hand-written benign inputs: every ordinary operator use of these very flags. `git clone --upload-pack=/usr/local/bin/git-upload-pack` is how you clone from a host with git installed off-prefix; `rsync --rsh=/usr/bin/ssh` is how a cron job with a minimal PATH names its transport; `tar --use-compress-program=/usr/bin/zstd`, `sort --compress-program=/bin/gzip`, `mysql --pager=/usr/bin/less`, `wget --use-askpass=/usr/local/bin/askpass` and ripgrep's own documented `--pre=./scripts/pdf-to-text.sh` are all routine. Worse, a security advisory describing this CVE in prose matched, and so did this rule's own description text. All three conditions are now anchored to a JSON parameter key, which is also the shape production actually produces (the hook builds tool_args as JSON.stringify(toolInput)). The flag in a command line is an operator's choice; the same flag sitting in a slot the schema calls `pattern` is the attack. TWO FURTHER NARROWINGS from the same review. Condition 2 previously accepted a space as well as `=`, and accepted a relative `bin/`, so `{"target":"--volume /usr/bin/docker:/usr/bin/docker"}` and `{"glob":"--iglob=bin/**"}` matched; it now requires `=` and an absolute path naming a FILE under bin, which also separates an executor target from an install prefix such as `--bindir=/usr/local/bin/`. Condition 3 previously matched a bare `-exec`, so an agent grepping a repo for that literal string matched; it now requires the `{}` placeholder that makes the value an actual find predicate.

Response Actions

References

1. 01

   A parameter the tool schema treats as data holds an option known to make its CLI spawn a process, and the option's value reaches an executable — a named program in a bin directory, a world-writable staging directory, a script file, or a bare interpreter name

   field: contentop: regex
2. 02

   A parameter the tool schema treats as data holds an option-shaped value whose payload is an absolute path to a named program in a bin directory — an executor flag wearing an operand's name

   field: contentop: regex
3. 03

   A filename or glob parameter whose value is a complete find -exec predicate, command plus {} placeholder, turning a directory walk into command execution once per matched file

   field: contentop: regex

Attack Examples (Rule Triggers)

1. {"tool":"filesystem_search_files","arguments":{"pattern":"--pre=/bin/sh","path":"/home/app"}}

2. {"tool":"search","arguments":{"pattern":"--pre=/usr/bin/env","dir":"src"}}

3. {"tool":"extract_archive","arguments":{"member":"--to-command=/tmp/p.sh"}}

4. {"tool":"download","arguments":{"target":"--use-askpass=/tmp/p.sh"}}

5. {"tool":"sync_dir","arguments":{"src":"--rsh=/tmp/p.sh"}}

6. {"tool":"list_files","arguments":{"name":"-exec /bin/sh {} ;"}}

7. {"tool":"grep_repo","arguments":{"query":"--wibble=/usr/local/bin/stage"}}

Real-world attack payloads, sanitized and versioned alongside the rule as regression tests — so a future revision can't silently stop catching them.

Benign Examples (Rule Doesn't Trigger)

1. An ordinary regex search pattern, the overwhelmingly common case

   {"tool":"search","arguments":{"pattern":"TODO\\(human\\)","dir":"src"}}

2. An everyday git partial-clone flag — flag-shaped but its value names no program

   git clone --filter=blob:none --depth 1 https://github.com/example/repo.git

3. A legitimate output path passed as a flag, the case that forced the bin-directory requirement

   {"tool":"build","arguments":{"args":"--output=/tmp/report.json --verbose"}}

4. Prose describing the attack without carrying the flag-plus-path payload

   Our security README documents the ripgrep argument-injection issue: when an LLM controls the search pattern, ripgrep can be turned into a script executor, so we pass -- before the pattern.

5. A sensitive-looking but syntactically ordinary search term — this rule is about shape, not about the word

   {"tool":"filesystem_search_files","arguments":{"pattern":"password","path":"/etc"}}

6. Normal rsync invocation with an exclude pattern

   rsync -av --exclude=node_modules ./src/ backup:/srv/app/

7. Turborepo package filters — the measured false positive that removed --filter from the flag list

   turbo build --filter=./apps/* && turbo build --filter=@myorg/web

8. The ssh option-injection surface belongs to ATR-2026-02370; this rule deliberately does not claim it

   call ssh_connect with hostAlias: "-oProxyCommand=/tmp/p.sh"

9. Documented git usage for a remote with git installed off-prefix — the flag is the operator's, not a smuggled operand

   If git is installed outside the default prefix on the server you have to tell the client where to find it: git clone --upload-pack=/usr/local/bin/git-upload-pack deploy@build01:/srv/git/api.git and for pushes use git push --receive-pack=/usr/local/bin/git-receive-pack origin main

10. Ordinary rsync transport selection in a deployment script

    The cron user has a minimal PATH, so give rsync the absolute transport: rsync -az --delete --rsh=/usr/bin/ssh ./public/ web@edge1:/var/www/public/

11. ripgrep's own documented preprocessor workflow, on a command line rather than in a parameter slot

    To grep inside PDFs, ripgrep supports a preprocessor. Write a small wrapper and point --pre at it: rg --pre=./scripts/pdf-to-text.sh --pre-glob='*.pdf' 'quarterly revenue' docs/

12. Legitimate archive tooling — previously a declared false positive, now excluded by construction

    Nightly backup job (zstd is much faster than gzip on this box): tar --use-compress-program=/usr/bin/zstd -cf /backups/app.tar.zst /srv/app

13. A security advisory describing this exact attack class in prose; detection content must not trip its own detection

    Security advisory: because the search pattern was passed to ripgrep as a positional argument with no end-of-options separator, a model-supplied pattern of --pre=/bin/sh caused ripgrep to execute the interpreter once per file walked. Fixed by inserting -- before the pattern.

14. A legitimate MCP tool description documenting its own preprocessor — the flag is in prose, not in an operand slot

    {"name":"search_documents","description":"Full-text search across the docs corpus. Binary formats are handled by a preprocessor configured as --pre=/usr/local/bin/doc-extract; the caller only supplies the query string."}

15. Ordinary CI log output echoing the commands it ran

    + tar --use-compress-program=/usr/bin/zstd -xf artifacts.tar.zst -C /workspace
    + rsync --rsh=/usr/bin/ssh -a /workspace/dist/ deploy@cdn:/srv/static/
    Done in 41s.

16. A docker-in-docker bind mount — flag-shaped and pointing into /usr/bin, but space-separated and not an executor option

    {"tool":"container_run","arguments":{"target":"--volume /usr/bin/docker:/usr/bin/docker"}}

17. A relative glob naming the bin directory as a search scope, not an absolute path to a program

    {"tool":"ripgrep_search","arguments":{"query":"TODO","glob":"--iglob=bin/**"}}

18. An audit agent grepping the repo for the literal string -exec; without the {} placeholder the value is not a find predicate

    {"tool":"search_code","arguments":{"pattern":"-exec","path":"scripts/"}}

19. An install prefix naming the bin DIRECTORY, under a key that IS in the data-key list — the trailing-filename requirement is what separates it from an executor target

    {"tool":"run_build","arguments":{"path":"--bindir=/usr/local/bin/"}}

20. A wrapper's generic extra-arguments parameter legitimately carrying a compressor flag; `value` and `input` name no operand, so they were removed from the data-key list

    {"tool":"tar_extract","arguments":{"archive":"app.tar.zst","value":"--use-compress-program=/usr/bin/zstd"}}

21. A shell tool receiving a whole command line — the flag is not in the operand position of a data parameter

    {"tool":"shell","arguments":{"input":"tar --use-compress-program=/usr/bin/zstd -cf a.tar.zst d/"}}

22. A well-designed rsync wrapper that gives the transport its own parameter — the value is a path, not a flag

    {"tool":"rsync","arguments":{"src":"/data/","dest":"host:/backup/","rsh":"/usr/bin/ssh"}}

23. Grepping a repo for the flag NAME during an audit; with no value reaching an executable there is nothing to execute

    {"tool":"search_code","arguments":{"pattern":"--use-compress-program","path":"scripts/"}}

24. A path parameter holding a genuine absolute path to a binary — a path is not an option

    {"tool":"file_stat","arguments":{"path":"/usr/local/bin/terraform"}}

Known False Positive Contexts

• ▸A developer or skill that legitimately passes ripgrep's --pre preprocessor through an agent tool AS the search-pattern parameter (searching inside PDFs or archives). Expected to match; the rule cannot distinguish an intended preprocessor from an injected one once it is sitting in the operand slot
• ▸An MCP tool whose schema genuinely names its transport parameter `src` or `target` and expects a --rsh= / --use-askpass= value there. Rare — real wrappers give the transport its own parameter — but it would match
• ▸An agent searching a codebase for the literal predicate `-exec rm {}` during a security audit: the value is a complete find predicate under a `pattern` key, which is the detected shape
• ▸RESIDUAL, and not fixable by pattern: an advisory or writeup that quotes the PoC as a verbatim JSON tool call rather than describing it in prose. The quoted payload is byte-identical to the live attack. Prose descriptions of the attack — the far more common documentation shape, and the one ATR's own docs use — are clean and are pinned as true_negatives. Code-block suppression (tags.suppress_in_code_blocks) would silence the fenced case but was deliberately NOT enabled: a poisoned SKILL.md or README that carries the malicious tool call inside a fenced block is a live indirect-injection channel, and suppressing it would blind the rule there

title: "Option-Flag Smuggling in an LLM-Controlled Tool Parameter"
id: ATR-2026-02528
rule_version: 1
status: experimental
description: >
  Detects a tool parameter that should carry DATA -- a search pattern, a
  filename, a hostname -- but instead carries an OPTION FLAG whose value names
  a program. The underlying CLI parses the value as an option rather than an
  operand and executes what it points at, so the agent never issues a shell
  command and no shell metacharacter ever appears.

  Derived from CVE-2026-48116 (AnythingLLM before 1.13.0): the
  filesystem-search-files agent skill passes its LLM-controlled `pattern`
  parameter to ripgrep as a positional argument with no `--` end-of-options
  separator. ripgrep treats any argument beginning with `-` as an option, so a
  pattern of `--pre=/bin/sh` turns the search tool into a script executor that
  runs the interpreter once per file it walks.

  WHY EXISTING COVERAGE MISSES THIS. Shell-metacharacter rules
  (ATR-2026-00111, ATR-2026-00066) key on `;`, `&&`, backticks, `$(`, pipes.
  A smuggled flag contains none of them: `--pre=/bin/sh` is a well-formed
  single token with no separator, no quoting, and no subshell. Measured
  against the engine before this rule was written, that exact parameter
  produced zero matches across the whole corpus. The invariant that does hold
  is positional: a value that is syntactically an option, sitting where the
  tool schema says an operand goes.

  GENERALISATION. The flag family is enumerated from the CLIs an agent
  actually drives, not from the one vendor: ripgrep --pre / --pre-glob, tar
  --to-command / --use-compress-program, wget --use-askpass, git
  --upload-pack / --receive-pack, sort --compress-program, mysql --pager,
  rsync --rsh, find -exec. Condition 2 generalises past the list entirely:
  ANY flag-shaped value whose payload is a path into a bin directory,
  appearing under a data-named JSON key.

  SSH IS OUT OF SCOPE ON PURPOSE. `-o ProxyCommand=` and its siblings belong
  to ATR-2026-02370, which owns the ssh/scp hostAlias surface and carries
  advisory prose about `-oProxyCommand=` as a declared true_negative. A
  condition here would have fired on that neighbour's benign set, which is a
  precision regression for it, so the ssh family was removed rather than
  duplicated.

  BOUNDARY, and how it was set. A value must both look like an option AND
  reach an executable: a named program under a bin directory, /tmp or
  /dev/shm, a .sh/.py/.pl script path, or a bare interpreter name. An earlier
  draft accepted any path-shaped value and any `--filter=`; measured against
  the 3,042-sample skills-sh corpus it fired three times, every hit on
  Turborepo documentation showing `--filter=./apps/*`. Both the `filter` flag
  and the loose path acceptance were removed for that reason.
  `--filter=blob:none` and `--output=/tmp/r.json` are also not matched, by
  construction.

  THE PARAMETER ANCHOR IS THE RULE (adversarial review, 2026-08-23). The first
  draft looked for the executor flag ANYWHERE in the content, dropping the
  positional invariant that the rest of this description argues is the only
  thing that holds. That version was blind on the 15,175-sample benign corpus
  and still fired on 16 of 20 hand-written benign inputs: every ordinary
  operator use of these very flags. `git clone
  --upload-pack=/usr/local/bin/git-upload-pack` is how you clone from a host
  with git installed off-prefix; `rsync --rsh=/usr/bin/ssh` is how a cron job
  with a minimal PATH names its transport; `tar
  --use-compress-program=/usr/bin/zstd`, `sort --compress-program=/bin/gzip`,
  `mysql --pager=/usr/bin/less`, `wget --use-askpass=/usr/local/bin/askpass`
  and ripgrep's own documented `--pre=./scripts/pdf-to-text.sh` are all
  routine. Worse, a security advisory describing this CVE in prose matched,
  and so did this rule's own description text. All three conditions are now
  anchored to a JSON parameter key, which is also the shape production
  actually produces (the hook builds tool_args as JSON.stringify(toolInput)).
  The flag in a command line is an operator's choice; the same flag sitting in
  a slot the schema calls `pattern` is the attack.

  TWO FURTHER NARROWINGS from the same review. Condition 2 previously accepted
  a space as well as `=`, and accepted a relative `bin/`, so
  `{"target":"--volume /usr/bin/docker:/usr/bin/docker"}` and
  `{"glob":"--iglob=bin/**"}` matched; it now requires `=` and an absolute path
  naming a FILE under bin, which also separates an executor target from an
  install prefix such as `--bindir=/usr/local/bin/`. Condition 3 previously
  matched a bare `-exec`, so an agent grepping a repo for that literal string
  matched; it now requires the `{}` placeholder that makes the value an actual
  find predicate.
author: "ATR Community"
date: "2026/08/23"
schema_version: "0.1"
detection_tier: pattern
maturity: test
severity: high

references:
  cve:
    - "CVE-2026-48116"
  cwe:
    - "CWE-88"
    - "CWE-77"
  owasp_llm:
    - "LLM05:2025"
  owasp_agentic:
    - "ASI02:2026"
  mitre_atlas:
    - "AML.T0053 - LLM Plugin Compromise"
    - "AML.T0051.001 - Indirect"

compliance:
  owasp_llm:
    - id: "LLM05:2025"
      context: "A model-produced parameter is handed to a process-spawning API without the separator that would keep it an operand; the mishandling is entirely on the output side."
      strength: primary
  owasp_agentic:
    - id: "ASI02:2026"
      context: "Tool misuse with no tool compromise: the search tool runs its normal code path, and the argument redefines what that path does."
      strength: primary
  eu_ai_act:
    - article: "15"
      context: "Article 15 requires that a high-risk system resist manipulation of its behaviour; a parameter that silently changes which program a tool executes is exactly such a manipulation."
      strength: primary
    - article: "9"
      context: "Argument injection through agent tool parameters is a foreseeable misuse for any agent with filesystem or process tooling and needs the continuous monitoring Article 9 mandates."
      strength: secondary
    - article: "14"
      context: "A human approving a search request cannot see that the search pattern is an executor flag; surfacing it restores meaningful oversight."
      strength: secondary
  nist_ai_rmf:
    - function: Manage
      subcategory: "MG.2.3"
      context: "Runtime treatment for argument injection, the tool-invocation failure mode that leaves no shell metacharacter to detect."
      strength: primary
    - function: Measure
      subcategory: "MS.2.7"
      context: "Detection events evidence the security of the parameter-to-process boundary for tools that spawn external binaries."
      strength: secondary
    - function: Map
      subcategory: "MP.5.1"
      context: "Distinguishes argument injection from command injection in the risk map; the mitigations differ (an end-of-options separator, not metacharacter escaping)."
      strength: secondary
  iso_42001:
    - clause: "8.1"
      context: "Operational control of tool invocation requires that parameters cannot redefine the tool's execution behaviour; this rule detects attempts to do so."
      strength: primary
    - clause: "8.4"
      context: "Impact assessment for an agent with search or archive tooling must include argument injection; these detections supply the evidence."
      strength: secondary
    - clause: "6.2"
      context: "Preventing unintended program execution through tool parameters is an AIMS security objective, operationalised as a runtime detection."
      strength: secondary

tags:
  category: privilege-escalation
  subcategory: argument-injection
  scan_target: both
  confidence: medium

agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any

detection:
  condition: any
  conditions:
    # -- 1: a known executor flag, IN A DATA-NAMED PARAMETER, whose value names
    # a program. {"pattern":"--pre=/bin/sh"} | {"member":"--to-command=/tmp/p.sh"}
    # The parameter anchor is load-bearing: without it this fired on every
    # ordinary CLI use of these flags (see BOUNDARY note above). The value
    # requirement is what additionally keeps --filter=blob:none out.
    - field: content
      operator: regex
      value: '(?i)"(?:pattern|query|search_?term|search|term|file_?name|file|member|entry|name|path|directory|dir|target|source|src|destination|dest|glob|regex|expr|domain|hostname|host)"\s*:\s*"\s*--(?:pre-glob|pre|to-command|use-askpass|use-compress-program|compress-program|upload-pack|receive-pack|rsh|pager)\s*=\s*[''"]?\s*(?:/(?:usr/)?(?:local/)?s?bin/[a-z0-9_.-]{1,40}|/(?:tmp|var/tmp|dev/shm)/|[~.]{0,2}/[^\s''"]{0,40}\.(?:sh|bash|zsh|py|pl|rb|js|mjs|php)\b|\bsh\b|\bbash\b|\bzsh\b|\bdash\b|\bpython[23]?\b|\bperl\b|\bruby\b|\bnode\b|\benv\b|\bawk\b|\bcurl\b|\bwget\b)'
      description: "A parameter the tool schema treats as data holds an option known to make its CLI spawn a process, and the option's value reaches an executable — a named program in a bin directory, a world-writable staging directory, a script file, or a bare interpreter name"

    # -- 2: generalisation past the enumerated flag list --
    # Any flag-shaped value under a data-named key that names a FILE inside a
    # bin directory. The trailing filename is what separates an executor target
    # (--wibble=/usr/local/bin/stage) from an install prefix (--bindir=/usr/local/bin/).
    - field: content
      operator: regex
      value: '(?i)"(?:pattern|query|search_?term|search|term|file_?name|file|member|entry|name|path|directory|dir|target|source|src|destination|dest|glob|regex|expr|domain|hostname|host)"\s*:\s*"\s*--?[a-z][a-z0-9-]{1,24}=\s*[''"]?/(?:usr/)?(?:local/)?s?bin/[a-z0-9_.-]{1,40}'
      description: "A parameter the tool schema treats as data holds an option-shaped value whose payload is an absolute path to a named program in a bin directory — an executor flag wearing an operand's name"

    # -- 3: find-style predicate smuggled into a name/glob parameter --
    # The {} placeholder is required: it is what makes the value a find
    # PREDICATE rather than the literal string "-exec" someone is grepping for.
    - field: content
      operator: regex
      value: '(?i)"(?:pattern|name|glob|path|file_?name|search|query|term)"\s*:\s*"\s*-exec(?:dir)?\s+[^"\\{]{1,40}\{\}'
      description: "A filename or glob parameter whose value is a complete find -exec predicate, command plus {} placeholder, turning a directory walk into command execution once per matched file"

  false_positives:
    - "A developer or skill that legitimately passes ripgrep's --pre preprocessor through an agent tool AS the search-pattern parameter (searching inside PDFs or archives). Expected to match; the rule cannot distinguish an intended preprocessor from an injected one once it is sitting in the operand slot"
    - "An MCP tool whose schema genuinely names its transport parameter `src` or `target` and expects a --rsh= / --use-askpass= value there. Rare — real wrappers give the transport its own parameter — but it would match"
    - "An agent searching a codebase for the literal predicate `-exec rm {}` during a security audit: the value is a complete find predicate under a `pattern` key, which is the detected shape"
    - "RESIDUAL, and not fixable by pattern: an advisory or writeup that quotes the PoC as a verbatim JSON tool call rather than describing it in prose. The quoted payload is byte-identical to the live attack. Prose descriptions of the attack — the far more common documentation shape, and the one ATR's own docs use — are clean and are pinned as true_negatives. Code-block suppression (tags.suppress_in_code_blocks) would silence the fenced case but was deliberately NOT enabled: a poisoned SKILL.md or README that carries the malicious tool call inside a fenced block is a live indirect-injection channel, and suppressing it would blind the rule there"

response:
  actions:
    - alert
  actions_rationale: >-
    response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): no FP measurement on the
    benign corpus; ceiling = observe. Removed block_tool(interrupt). Detection unchanged —
    recall cost is zero.
  auto_response_threshold: high
  message_template: >
    [ATR-2026-02528] A tool parameter that should be data is an option flag
    naming a program. The tool will execute it rather than search for it
    (CVE-2026-48116 shape). Pass an end-of-options separator before
    model-controlled operands.

confidence: 70

test_cases:
  true_positives:
    - input: "{\"tool\":\"filesystem_search_files\",\"arguments\":{\"pattern\":\"--pre=/bin/sh\",\"path\":\"/home/app\"}}"
      expected: triggered
      description: "The CVE-2026-48116 shape: ripgrep's preprocessor flag arriving as the search pattern"
    - input: "{\"tool\":\"search\",\"arguments\":{\"pattern\":\"--pre=/usr/bin/env\",\"dir\":\"src\"}}"
      expected: triggered
      description: "Same flag pointing at env, which will run whatever follows"
    - input: "{\"tool\":\"extract_archive\",\"arguments\":{\"member\":\"--to-command=/tmp/p.sh\"}}"
      expected: triggered
      description: "tar --to-command turning extraction into execution"
    - input: "{\"tool\":\"download\",\"arguments\":{\"target\":\"--use-askpass=/tmp/p.sh\"}}"
      expected: triggered
      description: "wget --use-askpass invoked as a credential helper that is really a payload"
    - input: "{\"tool\":\"sync_dir\",\"arguments\":{\"src\":\"--rsh=/tmp/p.sh\"}}"
      expected: triggered
      description: "rsync --rsh replaced with a staged script, the transport-level equivalent of the ripgrep flag"
    - input: "{\"tool\":\"list_files\",\"arguments\":{\"name\":\"-exec /bin/sh {} ;\"}}"
      expected: triggered
      description: "find -exec predicate smuggled through a filename parameter"
    - input: "{\"tool\":\"grep_repo\",\"arguments\":{\"query\":\"--wibble=/usr/local/bin/stage\"}}"
      expected: triggered
      description: "A flag outside the enumerated list, caught by the bin-directory generalisation"
  true_negatives:
    - input: "{\"tool\":\"search\",\"arguments\":{\"pattern\":\"TODO\\\\(human\\\\)\",\"dir\":\"src\"}}"
      expected: not_triggered
      description: "An ordinary regex search pattern, the overwhelmingly common case"
    - input: "git clone --filter=blob:none --depth 1 https://github.com/example/repo.git"
      expected: not_triggered
      description: "An everyday git partial-clone flag — flag-shaped but its value names no program"
    - input: "{\"tool\":\"build\",\"arguments\":{\"args\":\"--output=/tmp/report.json --verbose\"}}"
      expected: not_triggered
      description: "A legitimate output path passed as a flag, the case that forced the bin-directory requirement"
    - input: "Our security README documents the ripgrep argument-injection issue: when an LLM controls the search pattern, ripgrep can be turned into a script executor, so we pass -- before the pattern."
      expected: not_triggered
      description: "Prose describing the attack without carrying the flag-plus-path payload"
    - input: "{\"tool\":\"filesystem_search_files\",\"arguments\":{\"pattern\":\"password\",\"path\":\"/etc\"}}"
      expected: not_triggered
      description: "A sensitive-looking but syntactically ordinary search term — this rule is about shape, not about the word"
    - input: "rsync -av --exclude=node_modules ./src/ backup:/srv/app/"
      expected: not_triggered
      description: "Normal rsync invocation with an exclude pattern"
    - input: "turbo build --filter=./apps/* && turbo build --filter=@myorg/web"
      expected: not_triggered
      description: "Turborepo package filters — the measured false positive that removed --filter from the flag list"
    - input: "call ssh_connect with hostAlias: \"-oProxyCommand=/tmp/p.sh\""
      expected: not_triggered
      description: "The ssh option-injection surface belongs to ATR-2026-02370; this rule deliberately does not claim it"
    # -- the ten inputs that broke the first draft (adversarial review 2026-08-23) --
    - input: "If git is installed outside the default prefix on the server you have to tell the client where to find it: git clone --upload-pack=/usr/local/bin/git-upload-pack deploy@build01:/srv/git/api.git and for pushes use git push --receive-pack=/usr/local/bin/git-receive-pack origin main"
      expected: not_triggered
      description: "Documented git usage for a remote with git installed off-prefix — the flag is the operator's, not a smuggled operand"
    - input: "The cron user has a minimal PATH, so give rsync the absolute transport: rsync -az --delete --rsh=/usr/bin/ssh ./public/ web@edge1:/var/www/public/"
      expected: not_triggered
      description: "Ordinary rsync transport selection in a deployment script"
    - input: "To grep inside PDFs, ripgrep supports a preprocessor. Write a small wrapper and point --pre at it: rg --pre=./scripts/pdf-to-text.sh --pre-glob='*.pdf' 'quarterly revenue' docs/"
      expected: not_triggered
      description: "ripgrep's own documented preprocessor workflow, on a command line rather than in a parameter slot"
    - input: "Nightly backup job (zstd is much faster than gzip on this box): tar --use-compress-program=/usr/bin/zstd -cf /backups/app.tar.zst /srv/app"
      expected: not_triggered
      description: "Legitimate archive tooling — previously a declared false positive, now excluded by construction"
    - input: "Security advisory: because the search pattern was passed to ripgrep as a positional argument with no end-of-options separator, a model-supplied pattern of --pre=/bin/sh caused ripgrep to execute the interpreter once per file walked. Fixed by inserting -- before the pattern."
      expected: not_triggered
      description: "A security advisory describing this exact attack class in prose; detection content must not trip its own detection"
    - input: "{\"name\":\"search_documents\",\"description\":\"Full-text search across the docs corpus. Binary formats are handled by a preprocessor configured as --pre=/usr/local/bin/doc-extract; the caller only supplies the query string.\"}"
      expected: not_triggered
      description: "A legitimate MCP tool description documenting its own preprocessor — the flag is in prose, not in an operand slot"
    - input: "+ tar --use-compress-program=/usr/bin/zstd -xf artifacts.tar.zst -C /workspace\n+ rsync --rsh=/usr/bin/ssh -a /workspace/dist/ deploy@cdn:/srv/static/\nDone in 41s."
      expected: not_triggered
      description: "Ordinary CI log output echoing the commands it ran"
    - input: "{\"tool\":\"container_run\",\"arguments\":{\"target\":\"--volume /usr/bin/docker:/usr/bin/docker\"}}"
      expected: not_triggered
      description: "A docker-in-docker bind mount — flag-shaped and pointing into /usr/bin, but space-separated and not an executor option"
    - input: "{\"tool\":\"ripgrep_search\",\"arguments\":{\"query\":\"TODO\",\"glob\":\"--iglob=bin/**\"}}"
      expected: not_triggered
      description: "A relative glob naming the bin directory as a search scope, not an absolute path to a program"
    - input: "{\"tool\":\"search_code\",\"arguments\":{\"pattern\":\"-exec\",\"path\":\"scripts/\"}}"
      expected: not_triggered
      description: "An audit agent grepping the repo for the literal string -exec; without the {} placeholder the value is not a find predicate"
    - input: "{\"tool\":\"run_build\",\"arguments\":{\"path\":\"--bindir=/usr/local/bin/\"}}"
      expected: not_triggered
      description: "An install prefix naming the bin DIRECTORY, under a key that IS in the data-key list — the trailing-filename requirement is what separates it from an executor target"
    - input: "{\"tool\":\"tar_extract\",\"arguments\":{\"archive\":\"app.tar.zst\",\"value\":\"--use-compress-program=/usr/bin/zstd\"}}"
      expected: not_triggered
      description: "A wrapper's generic extra-arguments parameter legitimately carrying a compressor flag; `value` and `input` name no operand, so they were removed from the data-key list"
    - input: "{\"tool\":\"shell\",\"arguments\":{\"input\":\"tar --use-compress-program=/usr/bin/zstd -cf a.tar.zst d/\"}}"
      expected: not_triggered
      description: "A shell tool receiving a whole command line — the flag is not in the operand position of a data parameter"
    - input: "{\"tool\":\"rsync\",\"arguments\":{\"src\":\"/data/\",\"dest\":\"host:/backup/\",\"rsh\":\"/usr/bin/ssh\"}}"
      expected: not_triggered
      description: "A well-designed rsync wrapper that gives the transport its own parameter — the value is a path, not a flag"
    - input: "{\"tool\":\"search_code\",\"arguments\":{\"pattern\":\"--use-compress-program\",\"path\":\"scripts/\"}}"
      expected: not_triggered
      description: "Grepping a repo for the flag NAME during an audit; with no value reaching an executable there is nothing to execute"
    - input: "{\"tool\":\"file_stat\",\"arguments\":{\"path\":\"/usr/local/bin/terraform\"}}"
      expected: not_triggered
      description: "A path parameter holding a genuine absolute path to a binary — a path is not an option"