Security audit

RTK Integration

Security checks across malware telemetry and agentic risk

Overview

The skill has a coherent token-saving purpose, but its setup path can automatically run unpinned remote code and persistently modify shell startup files.

Install only if you are comfortable with RTK being added to your shell environment. Prefer Homebrew or a pinned, reviewed release instead of the provided `curl | sh` installer, review any shell profile changes, and use raw commands when you need complete output for commits, pushes, installs, failures, or security-sensitive debugging.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill instructs the agent to execute shell commands, including installation and system modification steps, but does not declare any permissions or capability boundaries. That mismatch can cause the skill to be invoked in contexts where shell execution is not expected or appropriately reviewed, increasing the chance of unsafe automated actions.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The setup script persistently modifies the user's shell startup files by appending to ~/.zshrc, ~/.bashrc, or ~/.profile without explicit confirmation. Even though this is framed as convenience for RTK integration, it exceeds a narrow 'check/install' action and creates lasting environment changes that may surprise users or conflict with existing shell configuration.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script downloads and executes a remote installer directly from GitHub using curl piped to sh, which gives network-delivered code immediate execution on the host. This is dangerous because compromise of the source repository, branch, transport assumptions, or installer content would lead to arbitrary code execution during setup.

Vague Triggers

Medium

Confidence: 77% confidence
Finding: The trigger phrases are broad and include generic optimization language like 'reduce costs' and 'context window', which may activate the skill in unrelated conversations. In this skill, unintended invocation is more dangerous because the instructions push immediate setup and shell execution, including remote installation.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The installation guidance tells the agent or user to execute a remote installer and modify shell startup files without a prominent warning about the risks. This is dangerous because it normalizes trust in unaudited remote code and persistent environment changes, especially when the skill also says to 'immediately run the setup script' on install.

Missing User Warnings

High

Confidence: 99% confidence
Finding: Fetching a shell script from the network and piping it straight to sh executes unreviewed remote code without any warning, pause, or consent step. In an auto-run setup context, this is especially risky because the user may not realize that arbitrary installation logic is being executed immediately.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script writes a PATH modification into the user's shell profile without explicit notice or confirmation, creating a persistent behavioral change in future sessions. While the content added is simple, silent profile edits can disrupt user environments, mask binaries, or violate expectations for what an install helper should change automatically.

External Script Fetching

Low

Category: Supply Chain
Content: ```bash # Linux/macOS curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh | sh echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc && source ~/.bashrc # macOS Homebrew
Confidence: 97% confidence
Finding: The skill fetches and executes installation content from an external URL on GitHub. Even if the source is legitimate, remote script fetching introduces supply-chain risk, branch mutability risk, and loss of local review before execution.

Chaining Abuse

High

Category: Tool Misuse
Content: ```bash # Linux/macOS curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh | sh echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc && source ~/.bashrc # macOS Homebrew
Confidence: 99% confidence
Finding: Piping curl output directly into sh is a classic unsafe execution pattern because it runs network-delivered code immediately with no opportunity for validation. In this skill, the risk is amplified by the instruction to perform setup automatically during install, which could lead to silent compromise if the remote content is altered.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.