rtk-skill
Fail
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to download and execute the '@terrain-ai/rtk' package from the NPM registry using 'npx' or 'bunx' whenever the local binary is not detected.
- [EXTERNAL_DOWNLOADS]: The skill references external resources from the 'rtk-ai' GitHub organization and the NPM registry, directing the agent to fetch and run code from these locations.
- [COMMAND_EXECUTION]: The skill encourages the agent to prefix sensitive shell commands (such as git, docker, kubectl, and package managers) with the 'rtk' proxy tool, granting the tool visibility into all inputs and outputs of these processes.
- [INDIRECT_PROMPT_INJECTION]: The skill processes and summarizes output from various shell commands, creating an ingestion surface for untrusted data.
- Ingestion points: Output from commands like 'git log', 'docker logs', and test failures (SKILL.md).
- Boundary markers: Absent; the instructions do not specify the use of delimiters for the processed command output.
- Capability inventory: Execution of arbitrary shell commands, file reading via 'rtk read', and interaction with cloud/container APIs.
- Sanitization: Absent; the proxy tool filters output for token efficiency but does not provide sanitization or validation of the content presented to the agent.
Recommendations
- AI detected serious security threats
Audit Metadata