AI Agent Spawning Shell Interpreter or Fetching Tools During Repo Init
Detects AI-powered development tools like Claude Code (running via node) spawning shell interpreters, executing common setup/configuration scripts, or invoking network utilities during project initialization. This activity is indicative of indirect prompt injection attacks where an adversary lures an AI agent into executing malicious code from a repository.
Sigma
