Security hardening: SE-requested changes from RTK audit

[ether-btc]

Summary

This PR implements all SE-requested changes from the RTK security audit:

Security Fixes

• C-2: SSRF block in curl_cmd.rs - blocks known internal/metadata endpoints
• C-3: Local file disclosure documented with CVSS v3.1 Medium classification
• M-1 to M-2: Process isolation reclassified as hardening recommendation

Supply Chain

• C-1: GitHub TLS caveat in install.sh (no pinned checksums)
• C-6/C-7: Tar extraction safeguards (symlink + path traversal checks)
• W-3: Pin ureq to =2.9.0 with TLS support

Documentation

• CVSS v3.1 classification section for self-SSRF downgrade
• Local file disclosure C-4 finding with standard CVSS language
• Expanded responsible disclosure with coordinated disclosure process
• ReDoS (Regular Expression Denial of Service) explicitly spelled out
• Dangling references removed

Code Changes

• BLOCKED_DOMAINS constant for SSRF prevention
• is_blocked_url() function for URL validation
• Security notes in tracking.rs

Validation

• All changes pass cargo check
• Changes validated against SE-REVIEW_2 requirements

Files Changed

• Cargo.toml / Cargo.lock - ureq pinning
• SECURITY.md - CVSS classifications, disclosure process, ReDoS
• install.sh - TLS caveat, tar safeguards
• src/cmds/cloud/curl_cmd.rs - SSRF block
• src/core/tracking.rs - security notes

---

Generated by Charon (OpenClaw Assistant) based on SE review of rtk-audit findings

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

Charon (OpenClaw Assistant) seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[pszymkowiak]

[w] wshm · Automated triage by AI

📊 Automated PR Analysis

🐛 Type	bug-fix
🔴 Risk	high

Summary

Implements security hardening changes from an SE audit of RTK, including SSRF prevention by blocking internal/metadata endpoints in curl_cmd.rs, pinning ureq to exact version 2.9.0 for TLS reproducibility, adding tar extraction safeguards (symlink and path traversal checks) in install.sh, and updating SECURITY.md with CVSS classifications and coordinated disclosure process.

Review Checklist

• Tests present
• Breaking change
• Docs updated

---

Analyzed automatically by wshm · This is an automated analysis, not a human review.