cli output compression for token savings with rtk

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:11 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a documented command-output compressor, but it also tells agents to display AWS environment variables and describes output logging/history behavior without enough secret-handling guidance.

Review before installing. The normal `rtk` wrapper use is aligned with token reduction, but avoid using the environment-variable feature on secret-bearing prefixes such as AWS, TOKEN, GCP, AZURE, or similar names unless values are redacted. Also account for local tee logs and command-history analytics retaining command output on the machine.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documented `rtk env -f AWS` example explicitly encourages filtering and displaying environment variables associated with AWS, which commonly include highly sensitive credentials. In an LLM-agent workflow, this is especially risky because secrets may be surfaced into transcripts, stored logs, tee files, analytics, or model context, making accidental exfiltration more likely.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill documents an `rtk env -f AWS` capability that inspects environment variables, which is outside the core stated purpose of output compression and token reduction. In an agent context, encouraging environment-variable inspection can expose secrets such as API keys, cloud credentials, or tokens into model context or logs, especially because no warning or guardrails are provided.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Environment-variable filtering is context-inappropriate for a token-optimization wrapper because it provides a convenient path to enumerate and surface sensitive process or shell secrets. In an LLM-agent workflow, this becomes more dangerous because the agent may be encouraged to use the wrapper routinely, increasing the chance of accidental credential exposure in context or logs.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The documented `rtk env -f AWS` capability expands the tool from output compression into environment-variable inspection, which can expose secrets such as cloud credentials or tokens. In an agent context, even filtered env access is risky because it normalizes secret discovery through a wrapper that users may trust for benign token optimization.

Intent-Code Divergence

Low

• Confidence: 73% confidence
• Finding: The section introduces an optional auto-rewrite hook and explains that commands may be automatically rewritten before execution, but then states 'Not applicable for this deployment' and that manual prefixing is the expected pattern. This creates an intent/documentation inconsistency about whether hook-based command rewriting is part of the deployed skill's behavior.

Description-Behavior Mismatch

Low

• Confidence: 80% confidence
• Finding: The skill description presents RTK as a wrapper the user explicitly applies to commands, while this file documents a hook that rewrites commands before execution. Even though marked optional and 'not applicable for this deployment,' this is a broader behavioral mode than the manifest's straightforward wrapper description.

Static analysis

No suspicious patterns detected.