Security audit

RTK Token Compressor

Security checks for vulnerabilities and agentic risk

Overview

This plugin appears to do what it claims—wrap selected exec commands with a local RTK tool to reduce output size—but it relies on an undeclared local RTK binary.

This looks internally consistent for an RTK output-compression plugin. Before installing, confirm that you trust the `rtk` binary on your system, because this plugin will route many exec commands through it. Also note that the package does not install RTK for you and does not declare RTK as a requirement, so it may silently disable itself if RTK is missing.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: index.js:56
Evidence: execFileSync(candidate, ["--version"], { timeout: 3000, stdio: "pipe" });

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: index.ts:137
Evidence: execFileSync(candidate, ["--version"], { timeout: 3000, stdio: "pipe" });