@CARVIN94/dsh-router-ext-rtk

Once the extension is enabled, the command string that gets executed is whatever `rtk rewrite` prints, substituted after token freeze/approval of the original command. Because the listener returns its own envelope instead of calling next(), the remainder of the tools/execute waterfall (any later-registered guard/audit middleware) never runs, and the registry/transcript still renders the pre-rewrite command. The user-visible and audit-visible command therefore need not match the executed one, and an rtk-produced string is never re-approved.

Command execution is delegated to a binary located by an unvalidated environment variable or by the first X_OK hit among PATH and fixed fallback paths. Whatever that binary prints becomes the command executed on the host; no integrity check, signature or allowlist constrains it. A stale/poisoned rtk (or a DSH_RTK_BIN override) silently becomes an arbitrary-command injection point into every bash call.

Not executed by the plugin, but it is surfaced in the router panel as the recommended fix for the 'not ready' state, driving users to run an unpinned, unverified remote installer as their own user. Compromise of that branch/repo yields code execution on every machine that follows the hint, which in turn feeds the rewrite path above.