Rune

Performs adversarial red-team analysis on approved plans to identify edge cases, security risks, scalability issues, error paths, and integration risks befor...

Security Scan

The Rune package is a large, multi-skill mesh whose instructions aggressively direct agent behavior (including file reads/writes and shell/git commands) and contain prompt-injection patterns; the footprint is plausible for a dev-assistant but the prompt-style gating, embedded hard-gates, and presence of code files with no install spec merit caution and a manual code review before use.

Purpose & Capability

The registry description given to you emphasized an 'adversarial red-team analysis' capability, but the bundle actually contains a 59–61-skill mesh (many L1–L4 skills) that route tasks, read and write project files, run git commands, and orchestrate other skills. That breadth is coherent for a 'mesh' product, but it does not match the single-purpose description you provided — the package is much larger than a single red-team skill would require.

Instruction Scope

SKILL.md and the per-skill .md files contain explicit runtime instructions that tell the agent to read project files (e.g., .rune/, docs/, README, src/), run shell/git commands, call other Rune skills, and write reports back into the repo. They also include authoritative-sounding 'MUST' and 'HARD-GATE' directives that are written like system-level policy. The pre-scan detected prompt-injection patterns (ignore-previous-instructions, system-prompt-override, unicode-control-chars). While some of these directives are plausible for coordinating a mesh, they could also be used to override or manipulate agent policy. The instructions therefore expand the agent's scope considerably and should be audited closely.

Install Mechanism

There is no install spec in the manifest (the SKILL.md shows 'clawhub install rune-kit' or 'npx @rune-kit/rune init' but openclaw plugin has no automated installer). That lowers surface risk from arbitrary downloads, but the bundle includes compiled/source code files (src/index.ts and scripts) even though no install is declared. Presence of code files without an install step is inconsistent — they could be inert documentation or executable code expected to run in the agent environment. You should inspect those files (especially src/index.ts and build scripts) before enabling.

Credentials

The skill declares no required environment variables, no primary credential, and no config paths. For a local project-focused mesh that reads repo files and runs git, that is reasonable. There are no explicit requests for cloud or secret credentials in the manifest. Still, the runtime instructions instruct reading files (including .rune and project config), so limit use on repos containing secrets until reviewed.

Persistence & Privilege

The skill is not 'always: true' and is user-invocable, which is normal. It explicitly instructs writing reports and saving files to the project (.rune/ and project root). That file-write behavior is expected for an audit/reporting mesh, but you should confirm the exact paths and examine the code that performs writes to ensure it doesn't modify unrelated skills or global agent configuration.

Scan Findings in Context

[ignore-previous-instructions] unexpected: SKILL.md contains explicit 'MUST'/'HARD-GATE' directives and phrases that the regex scanner matched as 'ignore previous instructions'. These appear as strong agent-level directives rather than harmless comments; such patterns are not necessary to implement a red-team or audit skill and are suspicious because they can be used to override or confuse higher-level policies.

[system-prompt-override] unexpected: The content includes authoritative enforcement language (e.g., 'Before ANY code response, you MUST: ...') that the scanner flagged as system-prompt-override. For an orchestration mesh this kind of internal workflow gating can be legitimate, but it is functionally similar to prompt-injection and should be treated carefully; verify it doesn't rely on hidden control characters or obfuscated directives.

[unicode-control-chars] unexpected: The scanner found unicode-control-characters signals in the SKILL.md content. These are sometimes used to obfuscate or trick parsers/prompt contexts. Even if used innocently for formatting, any use of control characters in runtime instructions should be inspected to ensure they are not being used to hide actions or to manipulate agent parsing.

What to consider before installing

What to check before installing/using Rune: - Manual code review: open and review src/index.ts and any scripts (e.g., skills/rune-slides-scripts/build-deck.js). Look for network calls, hard-coded endpoints, eval/child_process usage, obfuscated/unprintable characters, and any code that sends data off-host. - Inspect SKILL.md content and the per-skill .md files for authoritative 'MUST'/'HARD-GATE' directives that attempt to override agent/system behavior. Treat these like prompt-injection: they are instructions to the agent, not system policy. - Search the repository for external endpoints (http(s) URLs, IPs) and for calls that could exfiltrate files (fetch/axios/http.request, sockets, exec of curl/scp). If found, confirm purpose and destination. - Run the code in a sandboxed environment (isolated VM or container) first, and do not point it at repos that contain secrets, tokens, or production data until you are satisfied with its behavior. - If you expect only the 'adversary' red-team functionality, be aware this package is a full mesh (many skills). Consider disabling skills you don't need (openclaw.plugin.json provides a disabledSkills config) or using a trimmed fork that contains only the specific red-team module. - Ask the publisher for authoritative source and release checksum: confirm the claimed GitHub repo and compare commit hash or package checksum before trusting the bundle. What would change the assessment to 'benign': a short security review showing no outbound network calls, no obfuscated control characters, and a clear mapping of which files perform I/O; or an explicit, auditable installer that restricts runtime behavior. If you want, I can (1) list precise grep commands to find network/exec patterns in the code, or (2) summarize the contents of src/index.ts and the build script if you paste them here.

Less skills. Deeper connections.

61-skill mesh for AI coding assistants — 5-layer architecture, 200+ connections, 14 extension packs.

Install

clawhub install rune-kit

Or via npm:

npx @rune-kit/rune init

What is Rune?

Rune is a mesh — skills call each other bidirectionally, forming resilient workflows. If one skill fails, the mesh routes around it.

Use rune:cook for any code task, rune:team for parallel work, rune:launch for deploy, rune:rescue for legacy code.

Architecture

Layer	Role	Skills
L0	Router	skill-router
L1	Orchestrators	cook, launch, rescue, scaffold, team
L2	Workflow Hubs	adversary, audit, autopsy, ba, brainstorm, db, debug, deploy, design, docs, fix, incident, logic-guardian, marketing, mcp-builder, onboard, perf, plan, preflight, retro, review-intake, review, safeguard, scout, sentinel, skill-forge, surgeon, test
L3	Utilities	asset-creator, browser-pilot, completion-gate, constraint-check, context-engine, context-pack, dependency-doctor, doc-processor, docs-seeker, git, hallucination-guard, integrity-check, journal, neural-memory, problem-solver, research, sast, scope-guard, sentinel-env, sequential-thinking, session-bridge, slides, trend-scout, verification, video-creator, watchdog, worktree
L4	Extensions	14 domain packs

Extension Packs (L4)

ui · backend · devops · mobile · security · trading · saas · ecommerce · ai-ml · gamedev · content · analytics · chrome-ext · zalo

Links

• Source: github.com/rune-kit/rune
• Docs: rune-kit.github.io/rune
• Guides: rune-kit.github.io/rune/guides

License

MIT — v2.8.0