update-rtk-stats — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited update-rtk-stats (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Refreshes the live RTK savings counters shown on the claude-code-codex homepage. Single-purpose skill : read fresh stats from the local rtk binary, persist them in the repo, and propose a commit.
rtk binary isn't installed or in PATH (the skill will fail — RTK is required, not optional)RtkStats.astro)which rtk
rtk --versionIf rtk isn't found, stop and tell the user how to install it (https://github.com/rtk-ai/rtk).
The target file is frontend/src/data/rtk-stats.json inside the claude-code-codex repo. Confirm we're in or under that repo with git rev-parse --show-toplevel and that package.json mentions claude-code-codex somewhere. If not, ask the user to cd there first.
rtk gain --format jsonSample shape (keep this stable — RtkStats.astro reads these exact keys) :
{
"summary": {
"total_commands": 1546,
"total_input": 1889477,
"total_output": 1459761,
"total_saved": 433733,
"avg_savings_pct": 22.955,
"total_time_ms": 616294,
"avg_time_ms": 398
}
}Pipe through node (or jq if available) to add a lastUpdated ISO timestamp. Don't use jq blindly — the user's machine may not have it (verified case 2026-05-08).
Safe one-liner :
rtk gain --format json | node -e '
const fs = require("fs");
let data = "";
process.stdin.on("data", c => data += c);
process.stdin.on("end", () => {
const j = JSON.parse(data);
j.lastUpdated = new Date().toISOString();
fs.writeFileSync(process.argv[1], JSON.stringify(j, null, 2) + "\n");
console.log("wrote", process.argv[1]);
});
' frontend/src/data/rtk-stats.jsonexport PATH="$HOME/.nvm/versions/node/v22.22.2/bin:$PATH"
cd frontend && npm run build 2>&1 | tail -5The RtkStats.astro component is server-rendered and reads the JSON at build time. If the JSON shape drifted, the build will fail clearly.
git diff frontend/src/data/rtk-stats.jsonThen propose to the user :
git add frontend/src/data/rtk-stats.json
git commit -m "chore: refresh RTK stats (<short summary like 'now 1.5M saved'>)"
git pushDo NOT auto-push without confirmation — RTK stats refresh is a routine but visible commit on a public repo. Wait for the user's "go" before pushing.
frontend/src/data/rtk-stats.json.jq blindly — verified that Sylvain's machine doesn't have it. Always have a node-based fallback ready.RtkStats.astro. They're coupled — change both.rtk itself is broken. Sanity check first./save — captures meta learnings; /update-rtk-stats captures the quantitative trace of the collab./skillify — was used to extract concepts from Ruflo; this skill captures concepts from Sylvain's own daily-driver tooling.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.