Rtk Compress

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:14 AM UTC
• Version: 1.15.2

Overview

The skill is mostly a disclosed command-output compression helper, but its install instructions and broad command-wrapping guidance create review-worthy risk.

Review before installing. Prefer the package-manager install path and avoid the curl-to-sh fallback unless you pin and verify the installer yourself. Use rtk freely for read-only output reduction, but require normal user approval and full-output review for git mutations, pushes, GitHub actions, docker/kubectl operations, environment inspection, and network commands.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:18

Finding

Unverified Remote Installer Executed Directly by a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 18
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet:

bash

# or: curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh | sh

Technical Analysis

The installation instructions retrieve a shell script from the mutable master branch of an external GitHub repository and pipe the response directly into sh. This design combines downloading and execution into one operation, preventing routine inspection before execution.

The command does not pin the installer to an immutable release tag or commit and does not verify a cryptographic signature or documented checksum. Consequently, the effective payload can change after the Skill has been reviewed. HTTPS protects the connection in transit but does not establish that the current repository content is the same content that was audited.

Installing the rtk executable is relevant to the Skill's declared token-compression functionality. However, executing mutable and unverified network content is not the minimum-risk installation mechanism. A package-manager installation is already documented as the primary alternative and offers a more controlled distribution path.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or another component of the content-delivery trust chain.
2. The attacker modifies install.sh on the referenced master branch.
3. A user or agent follows the alternative installation instruction in SKILL.md.
4. curl retrieves the current attacker-controlled response.
5. The pipe sends that response directly to sh without integrity verification or prior inspection.
6. The malicious installer executes with all permissions available to the invoking user.

Impact Assessment

Successful exploitation permits arbitrary command execution under the invoking user ...[truncated 720 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | sh installation pipeline and retain the documented package-manager installation as the preferred method.
2. If a standalone installer is necessary, reference an immutable release artifact, signed tag, or full commit identifier rather than the mutable master branch.
3. Download the artifact to a local file instead of executing streamed network content.
4. Publish a SHA-256 checksum through an independently controlled or signed release channel and verify it before execution.
5. Prefer cryptographic signature verification using a documented publisher key where supported.
6. Allow users to inspect the downloaded script before running it.
7. Execute the installer with ordinary user privileges and clearly document any filesystem changes or exceptional permissions it requires.
8. Pin the installed rtk version so future upstream changes do not silently alter the reviewed behavior.

A safer installation pattern is:

bash

curl -fL -o install.sh "https://raw.githubusercontent.com/rtk-ai/rtk/<immutable-commit>/install.sh"
printf '%s  %s\n' '<documented-sha256>' 'install.sh' | sha256sum -c -
less install.sh
sh install.sh

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Piping curl output directly into sh is a classic command-chaining risk because it combines network retrieval and execution into one opaque step with no opportunity for inspection. In a skill meant for agent users, this pattern is especially dangerous because it can be copied verbatim and lead to silent execution of attacker-controlled shell code.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

bash

# 1. Install rtk
brew install rtk          # macOS
# or: curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh | sh

# 2. Verify
rtk gain  # Should show token savings stats

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

Then copy this `SKILL.md` to your agent's skills directory.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as a token-saving output compression helper, but it explicitly wraps mutating and privileged operations such as git add/commit/push, pull, GitHub CLI actions, docker/kubectl, and network fetches. That mismatch increases the chance an agent or user will grant it broader trust than warranted, leading to unintended repository, infrastructure, or network actions under the guise of a harmless formatting utility.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill encourages use of rtk for repository-mutating operations such as git add, commit, push, and pull, which exceed a simple output-compression role. In practice this could cause agents to treat a convenience wrapper as approved for making persistent changes, increasing the chance of accidental commits, pushes, or other state changes without adequate review.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Documenting curl, wget, GitHub CLI, and git push/pull under a token-compression skill extends it into network-capable execution without clearly tying that behavior to the stated purpose. In an agent setting, this can normalize outbound requests and data transfer, increasing risk of exfiltration, unintended remote actions, or use of external services when the operator expects only local output reduction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The documented use of env inspection can expose secrets, account identifiers, or internal configuration if run in a sensitive environment. Because the skill emphasizes compressed output rather than secrecy controls, users may incorrectly assume the wrapper makes such commands safe, when it only changes presentation and may still reveal high-value values or metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill lists networked commands and links to remote resources without warning that they can send data to external systems. In an agent context, omission of that warning is risky because users may not realize command arguments, repository metadata, logs, or fetched URLs can leave the local environment.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The install instructions include fetching and executing a remote script directly from GitHub, which bypasses package verification and executes whatever content is served at install time. If the remote source, repository, branch, or transport path is compromised, users can suffer immediate arbitrary code execution on their machine.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

bash

# 1. Install rtk
brew install rtk          # macOS
# or: curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh | sh

# 2. Verify
rtk gain  # Should show token savings stats

Static analysis

No suspicious patterns detected.