RTK Integration

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:27 AM UTC
• Version: 1.1.0

Overview

This skill is not proven malicious, but it asks the agent to auto-install and broadly trust an unverified external command wrapper that can affect future shell commands.

Review carefully before installing. Do not allow automatic setup unless you are comfortable running an unverified remote installer and letting RTK mediate broad shell activity. Prefer a pinned, checksum-verified release or package-manager install, avoid global hooks unless you understand exactly what they change, and keep RTK use to read-only or low-risk commands until you trust the installed binary.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/rtk-setup.sh:28

Finding

Automatic Execution of an Unpinned Remote Installation Script

Content

View full analysis

> ~/.bashrc && source ~/.bashrc ``` ### Technical Analysis The setup process downloads `install.sh` from the mutable `master` branch of an external GitHub repository and immediately pipes its contents to `sh`. It does not pin an immutable commit or release, verify a cryptographic checksum, validate a signature, or give the user an opportunity to inspect the downloaded payload. Because the remote installer is not included in the audited package, its effective behavior cannot be determined from the project. Its contents may also change after the Skill has been reviewed or published. The use of HTTPS protects the connection in transit but does not protect against compromise of the upstream repository, maintainer account, branch, or release process. Automatic installation supports the declared RTK integration functionality, but executing arbitrary mutable remote code is not the minimum privilege or least-risk mechanism necessary to provide that functionality. ### Attack Path 1. An attacker compromises the `rtk-ai/rtk` repository, a maintainer account, or another part of the upstream delivery process. 2. The attacker modifies `install.sh` on the `master` branch to include malicious shell commands. 3. The Skill directs installation to run `scripts/rtk-setup.sh` automatically. 4. `curl` r ...[truncated 1100 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/rtk-setup.sh:35

Finding

Automatic Persistent Modification of the User Shell Environment

Content

View full analysis

/dev/null; then echo "$PATH_LINE" >> "$PROFILE" echo " Added PATH to $PROFILE" fi ``` ### Technical Analysis The setup script modifies `.zshrc`, `.bashrc`, or `.profile` without requesting explicit consent. The appended command persists across future shell sessions and prepends the user-writable `~/.local/bin` directory to `PATH`. Persistent PATH configuration is convenient but is not required to verify or run RTK in the current process because the script already exports the directory locally: ```bash RTK_BIN="$HOME/.local/bin" export PATH="$RTK_BIN:$PATH" ``` Prepending a user-writable directory also increases executable-shadowing risk. If an attacker or compromised installer places a binary in `~/.local/bin` with the same name as a system command, later shell sessions may execute that binary before the legitimate system executable. The guard `grep -q '.local/bin'` is imprecise: any unrelated occurrence of that text prevents the intended line from being added, while the script provides no clearly delimited managed block, backup, or uninstall procedure. ### Attack Path 1. The Skill directs the setup script to run during installation. 2. The setup script obtains the user's active shell-profile path. 3. It appends a PATH modification that survives the current process. 4. A compromised remote installer or another process writes a spoofed executable i ...[truncated 773 chars]

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:35

Finding

Broad Command Mediation Through a Downloaded Binary and Optional Global Hooks

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (27)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manual installation flow includes a curl-to-shell pipeline with no safety warning, integrity verification, or pinning. This is dangerous because it executes whatever content is served remotely at that moment, enabling compromise via upstream account takeover, MITM in weaker environments, or malicious script changes.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The '| sh' pattern is a direct arbitrary-code-execution primitive: downloaded content is immediately executed without inspection. Within a skill that may guide automated agents, this substantially increases the likelihood of unsafe execution and rapid compromise if the upstream script is malicious or altered.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

bash

# Linux/macOS
curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh | sh
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc && source ~/.bashrc

# macOS Homebrew

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

Appending to ~/.bashrc and sourcing it is not inherently malicious, so the malware-labeled YARA match is likely overbroad. However, it does persistently alters the user's shell environment and is bundled with remote installation guidance, making it a genuine security concern in this context because it changes startup behavior without strong safeguards.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

l is installed, immediately run the setup script to install RTK if not already present:

bash

bash skills/rtk-integration/scripts/rtk-setup.sh

The script handles installation automatically (Linux/macOS), adds RTK to PATH, and verifies the install.

Manual install if needed:

bash

# Linux/macOS
curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh | sh
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc && source ~/.bashrc

# macOS Homebrew
brew install rtk

# Verify
rtk --version && rtk gain

2. Initialize hooks (optional, for Claude Code / OpenCode auto-rewriting)

bash

rtk init --global          # Claude Code hook
rtk init --global --opencode  # OpenCode hook

⚠️ For OpenClaw agents: hooks don't auto-apply. Use rtk <cmd> explicitly (see below).

3. Check token savings

bash

rtk gain

For config customization, see references/config.md.

---

Core Rule: Always Use RTK Prefixe

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | sh construct is the core dangerous behavior: it turns remote, unaudited network data into immediate shell execution in the user's environment. Because this script is intended to run automatically when the skill is installed, the chaining pattern materially elevates risk by enabling one-step compromise and persistence from any upstream tampering or install-script abuse.

Content

Scanner excerpt · scripts/rtk-setup.sh (reported line 32)May include surrounding context.

sh

brew install rtk
elif [[ "$OS" == "Linux" ]] || [[ "$OS" == "Darwin" ]]; then
  echo "   Using install script..."
  curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh | sh

  # Ensure PATH persists across sessions
  PROFILE=""

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes shell commands and instructs installation and configuration changes, but it declares no explicit tool scope or permissions boundaries. That increases the chance an agent can execute system-modifying actions without clear user awareness or policy gating.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are broad terms like 'reduce costs' and 'context window,' which can cause the skill to activate in unrelated situations. Because the skill includes installation and shell-execution guidance, accidental activation can lead to unnecessary or unexpected system-modifying recommendations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs immediate execution of a setup script during install, without requiring a clear warning or confirmation before changing the system. In agent contexts, 'run on install' behavior is especially risky because it normalizes automatic execution of code with side effects.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill's stated purpose is output compression, but it instructs users to perform remote software installation via a fetched script. That expands the trust boundary from local command formatting into arbitrary code execution from the network, which is substantially more dangerous than the skill's claimed function.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · references/commands.md (reported line 3)May include surrounding context.

md

# RTK Command Reference

Full list of RTK commands organized by category. Always prefer these over raw commands.

## Files

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script downloads and immediately executes a remote shell script via curl ... | sh from a moving branch reference (master) without pinning, verification, or user confirmation. This creates a supply-chain execution path where a compromised repository, DNS/TLS interception failure, or unexpected upstream change can result in arbitrary code execution on the user's machine during skill installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script persists a PATH modification into the user's shell profile automatically and without an explicit warning or opt-in. While not typically leading to immediate code execution by itself, silently changing startup files alters the user's environment and can create trust and persistence concerns, especially in an auto-run installation context.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

Fetching and executing an external script from a live URL introduces a supply-chain risk and delegates trust to the remote repository state. In this skill, the danger is elevated because the command is presented as a primary installation method for agents or users to follow directly.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

bash

# Linux/macOS
curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh | sh
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc && source ~/.bashrc

# macOS Homebrew

Static analysis

No suspicious patterns detected.