Rtk Compress

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:14 AM UTC
• Version: 1.15.2

Overview

The skill is mostly a disclosed command-output compression helper, but its install instructions and broad command-wrapping guidance create review-worthy risk.

Review before installing. Prefer the package-manager install path and avoid the curl-to-sh fallback unless you pin and verify the installer yourself. Use rtk freely for read-only output reduction, but require normal user approval and full-output review for git mutations, pushes, GitHub actions, docker/kubectl operations, environment inspection, and network commands.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:18
• Finding: Unverified Remote Installer Executed Directly by a Shell## Vulnerability Details **File Location**: `SKILL.md`, line 18 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Complete Code Snippet**: ```bash # or: curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh | sh ``` ### Technical Analysis The installation instructions retrieve a shell script from the mutable `master` branch of an external GitHub repository and pipe the response directly into `sh`. This design combines downloading and execution into one operation, preventing routine inspection before execution. The command does not pin the installer to an immutable release tag or commit and does not verify a cryptographic signature or documented checksum. Consequently, the effective payload can change after the Skill has been reviewed. HTTPS protects the connection in transit but does not establish that the current repository content is the same content that was audited. Installing the `rtk` executable is relevant to the Skill's declared token-compression functionality. However, executing mutable and unverified network content is not the minimum-risk installation mechanism. A package-manager installation is already documented as the primary alternative and offers a more controlled distribution path. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or another component of the content-delivery trust chain. 2. The attacker modifies `install.sh` on the referenced `master` branch. 3. A user or agent follows the alternative installation instruction in `SKILL.md`. 4. `curl` retrieves the current attacker-controlled response. 5. The pipe sends that response directly to `sh` without integrity verification or prior inspection. 6. The malicious installer executes with all permissions available to the invoking user. ### Impact Assessment Successful exploitation permits arbitrary command execution under the invoking user ...[truncated 720 chars]
• Remediation: ## Remediation Suggestions 1. Remove the `curl | sh` installation pipeline and retain the documented package-manager installation as the preferred method. 2. If a standalone installer is necessary, reference an immutable release artifact, signed tag, or full commit identifier rather than the mutable `master` branch. 3. Download the artifact to a local file instead of executing streamed network content. 4. Publish a SHA-256 checksum through an independently controlled or signed release channel and verify it before execution. 5. Prefer cryptographic signature verification using a documented publisher key where supported. 6. Allow users to inspect the downloaded script before running it. 7. Execute the installer with ordinary user privileges and clearly document any filesystem changes or exceptional permissions it requires. 8. Pin the installed `rtk` version so future upstream changes do not silently alter the reviewed behavior. A safer installation pattern is: ```bash curl -fL -o install.sh "https://raw.githubusercontent.com/rtk-ai/rtk/<immutable-commit>/install.sh" printf '%s %s\n' '<documented-sha256>' 'install.sh' | sha256sum -c - less install.sh sh install.sh ```

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# 1. Install rtk
brew install rtk          # macOS
# or: curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh | sh

# 2. Verify
rtk gain  # Should show token savings stats

• Confidence: 98% confidence
• Finding: Piping curl output directly into sh is a classic command-chaining risk because it combines network retrieval and execution into one opaque step with no opportunity for inspection. In a skill meant for agent users, this pattern is especially dangerous because it can be copied verbatim and lead to silent execution of attacker-controlled shell code.

Ae1

High

• Category: analysis-evasion

Content

Then copy this `SKILL.md` to your agent's skills directory.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as a token-saving output compression helper, but it explicitly wraps mutating and privileged operations such as git add/commit/push, pull, GitHub CLI actions, docker/kubectl, and network fetches. That mismatch increases the chance an agent or user will grant it broader trust than warranted, leading to unintended repository, infrastructure, or network actions under the guise of a harmless formatting utility.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill encourages use of rtk for repository-mutating operations such as git add, commit, push, and pull, which exceed a simple output-compression role. In practice this could cause agents to treat a convenience wrapper as approved for making persistent changes, increasing the chance of accidental commits, pushes, or other state changes without adequate review.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Documenting curl, wget, GitHub CLI, and git push/pull under a token-compression skill extends it into network-capable execution without clearly tying that behavior to the stated purpose. In an agent setting, this can normalize outbound requests and data transfer, increasing risk of exfiltration, unintended remote actions, or use of external services when the operator expects only local output reduction.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The documented use of env inspection can expose secrets, account identifiers, or internal configuration if run in a sensitive environment. Because the skill emphasizes compressed output rather than secrecy controls, users may incorrectly assume the wrapper makes such commands safe, when it only changes presentation and may still reveal high-value values or metadata.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill lists networked commands and links to remote resources without warning that they can send data to external systems. In an agent context, omission of that warning is risky because users may not realize command arguments, repository metadata, logs, or fetched URLs can leave the local environment.

External Script Fetching

Low

• Category: Supply Chain

Content

```bash
# 1. Install rtk
brew install rtk          # macOS
# or: curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh | sh

# 2. Verify
rtk gain  # Should show token savings stats

• Confidence: 97% confidence
• Finding: The install instructions include fetching and executing a remote script directly from GitHub, which bypasses package verification and executes whatever content is served at install time. If the remote source, repository, branch, or transport path is compromised, users can suffer immediate arbitrary code execution on their machine.

Static analysis

No suspicious patterns detected.