The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The rtk env command allows the agent to access and display environment variables, which commonly contain sensitive secrets, API keys, and authentication credentials.
[PERSISTENCE]: The skill includes commands rtk init and rtk init --global which modify CLAUDE.md and ~/.claude/CLAUDE.md. These files persist instructions across agent sessions, enabling long-term modification of the agent's behavior and potentially creating a persistent backdoor or redirection for all future commands.
[EXTERNAL_DOWNLOADS]: The skill directs users to install software from an external, unverified repository at https://github.com/rtk-ai/rtk. This source is not recognized as a trusted vendor and the repository provides arbitrary binaries that the agent is encouraged to use for all operations.
[COMMAND_EXECUTION]: The core functionality of the skill is designed to wrap and execute arbitrary shell commands (e.g., rtk <cmd>), providing a high-privilege surface for executing diverse CLI tools including network and system utilities.
[DYNAMIC_EXECUTION]: The tool acts as a runtime wrapper that processes and filters the output of other executables. This dynamic processing of command output via an external binary introduces a layer of execution that is not transparent to the agent or user.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a large attack surface for indirect prompt injection as it is designed to ingest and process data from various untrusted sources.
Ingestion points: The skill explicitly processes output from network tools (curl, wget), version control systems (git diff, git log), and package managers (npm, pnpm), all of which can return attacker-controlled data.
Boundary markers: There are no instruction delimiters or boundary markers mentioned to prevent the agent from obeying instructions embedded in the compacted command output.
Capability inventory: The skill environment has access to the file system, network operations, and arbitrary command execution via the rtk wrapper.
Sanitization: The skill description focuses on 'filtering and compacting' output for token savings but does not specify any sanitization or escaping mechanisms to prevent adversarial instructions from reaching the LLM context.

rtk