This rule detects the spawning of a system shell interpreter by a Celery worker process on a Linux host, which is a strong indicator that a Python-based background task framework is evaluating raw input within a shell execution context. Such behavior is highly suggestive of command execution or prompt-injection attempts targeting an LLM agent task. The detector looks for a child process where the executable image ends with a common shell binary (ash, bash, busybox, csh, dash, fish, ksh, sh, tcsh, zsh) and the parent command line contains the string "celery", while the parent image appears to be a Python interpreter (ends with "/python" or contains "/python3."). This combination aims to minimize false positives by tying the shell launch to a Celery task runner rather than generic shell invocation. The rule is labeled experimental and is scoped to Linux process creation events. False positives can arise from legitimate administrative tasks that invoke a shell with shell=True or os.system within Celery tasks, as well as media or deployment pipelines that shell out to tools like ffmpeg or git. The detection serves as a signal for further investigation into Celery task definitions, input validation, and potential RCE/prompt-injection risks in AI agent workflows.