new-project-setup
Fail
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill downloads a compiled binary from the 'rtk-ai' GitHub organization and extracts it directly into the system binary path '/usr/local/bin'. This bypasses standard package management and executes code from an unverified source.
- [EXTERNAL_DOWNLOADS]: Fetches a tarball from 'https://github.com/rtk-ai/rtk/releases/latest/download/rtk-x86_64-unknown-linux-musl.tar.gz'. The 'rtk-ai' organization is not a recognized trusted vendor.
- [PERSISTENCE]: Modifies the '~/.claude/settings.json' file to add an 'rtk hook claude'. This establishes a persistence mechanism that allows the 'rtk' tool to intercept or modify the agent's operations across sessions.
- [PRIVILEGE_ESCALATION]: The skill attempts to write to '/usr/local/bin', a directory that typically requires administrative privileges, indicating an attempt to perform system-level modifications.
- [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill reads project metadata from 'README.md', 'package.json', and 'go.mod' to determine project names and stacks.
- Boundary markers: None are implemented; the skill directly processes content from these files to seed the wiki.
- Capability inventory: The skill can create directories, write files, download/install system binaries, and modify agent configuration files.
- Sanitization: There is no evidence of sanitization or validation of the content read from project files before it is used in subsequent steps.
Recommendations
- AI detected serious security threats
Audit Metadata