Security audit
Security checks for vulnerabilities and agentic risk
The plugin is openly designed to rewrite shell commands, but it does so automatically through an external PATH-resolved tool and includes unsafe install and logging patterns that deserve review before use.
Review before installing. Use only in an environment where you trust the exact rtk binary resolved by the OpenClaw gateway PATH, avoid the curl-to-sh installer, and consider keeping audit logging disabled unless logs are protected and you accept that commands may contain secrets. Be aware that enabling this plugin can automatically alter exec commands across OpenClaw agents.
README.md:17Unverified Mutable Remote Script Is Piped Directly to a Shell
index.ts:11PATH-Resolved RTK Executable Can Replace Every Intercepted Shell Command
index.ts:47Audit Logs Persist Unredacted Commands and Allow Record Injection
Piping curl output directly to sh removes any opportunity for inspection and turns remote content into immediate code execution. In this plugin’s context, that is especially risky because the software modifies how an agent intercepts and rewrites shell commands, so compromise could lead to persistent execution of malicious logic in future agent workflows.
brew install rtk-ai/tap/rtk
# or
curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh | sh
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# Copy the plugin to OpenClaw's extensions directory
mkdir -p ~/.openclaw/extensions/rtk-rewrite
cp openclaw/index.ts openclaw/openclaw.plugin.json ~/.openclaw/extensions/rtk-rewrite/
# Enable in OpenClaw config
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
---
name: rtk-rewrite
version: "0.15.3"
author: "luw2007"
repository: "https://github.com/rtk-ai/rtk"
When auditing is enabled, the plugin writes full original and rewritten exec commands to a persistent log file on disk. Exec commands commonly contain secrets, file paths, tokens, hostnames, or other sensitive operational data, so this creates an unintended data-retention and disclosure risk beyond the plugin's stated rewrite role.
The manifest advertises transparent, automatic rewriting of shell commands without defining any trigger boundaries, exclusions, or safety conditions. In a plugin that intercepts exec tool calls, this can silently alter command semantics, expand scope unexpectedly, or bypass user/operator expectations, increasing the chance of unsafe execution or policy evasion.
The plugin supports verbose logging and hook-style audit logs of rewrite decisions, which can create persistent records of commands, arguments, file paths, or other sensitive session data. If these logs are stored insecurely or enabled in sensitive environments, they may expose operational details or secrets long after the session ends.
"verbose": {
"type": "boolean",
"default": false,
"description": "Log rewrite decisions to console for debugging"
},
"audit": {
"type": "boolean",
The README recommends fetching and executing an install script directly from a remote GitHub URL with no integrity verification or version pinning. If the upstream repository, branch, network path, or hosting account is compromised, users could execute attacker-controlled code immediately on their system.
brew install rtk-ai/tap/rtk
# or
curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh | sh
A rewrite plugin would be expected to invoke the rewrite engine, but consulting RTK_AUDIT_DIR and HOME introduces ambient environment access tied to an auxiliary logging feature. Because the manifest only describes rewrite delegation, this environment-variable-based path resolution is not clearly justified by the declared purpose.
No suspicious patterns detected.