Agent skill · security · rtk-ai
security-guardian
CLI security expert for RTK - command injection, shell escaping, hook security
Why this skill is useful
Provides specific command injection and shell escaping patterns that the AI wouldn't reliably generate on its own.
What it needs
About 7k tokens when loaded. Last updated 2026-08-06. 75,070 stars on the source repository.
What this skill does
Security Guardian Comprehensive security analysis for RTK CLI tool, focusing on command injection, shell escaping, hook security, and malicious input handling. When to Use Automatically triggered: After filter changes, shell command execution logic, hook modifications Manual invocation: Before release, after security-sensitive code changes Proactive: When handling user input, executing shell commands, or parsing untrusted output RTK Security Threat Model RTK faces unique security challenges as a CLI proxy that: 1. Executes shell commands based on user input 2. Parses untrusted command output (git, cargo, gh, etc.) 3. Integrates with Claude Code hooks (rtk-rewrite.sh, rtk-suggest.sh) 4. Routes commands transparently (command injection vectors) Threat Categories Threat Severity Impact Mitigation -------- ---------- -------- ------------ Command Injection 🔴 CRITICAL Remote code execution Input validation, shell escaping Shell Escaping 🔴 CRITICAL Arbitrary command execution Platform-specific escaping Hook Injection 🟡 HIGH Hook hijacking, command interception Permission checks, signature validation Malicious Output 🟡 MEDIUM RTK crash, DoS Robust parsing, error handling Path Traversal 🟢 LOW File access outside filters/ Path sanitization Security Analysis Workflow 1. Threat Identification Questions to ask for every code change: 2. Code Audit Patterns Command Injection Detection: Shell Escaping Vulnerability: Malicious Output Handling: Hook Injection Prevention: 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills rtk-ai/security-guardian