Fähigkeiten recoup-platform-email-helper

📦

recoup-platform-email-helper

Name: recoup-platform-email-helper
Author: recoupable

Inhaltsrevision r1 Hohes Risiko ⚙️ Externe Befehle🌐 Netzwerkzugriff📁 Dateisystemzugriff🔑 Umgebungsvariablen

Send Reliable Emails Through the Recoup API

Shell-built email payloads can break quoting and deliver empty messages. This helper validates content, serializes it safely, previews requests, and reports delivery failures.

Unterstützt: Claude Codex Code(CC)

⚠️ 38 Schlecht

Vor der Installation anhalten und eine Bestätigung anfordern.

Prüfen Sie den Plan und holen Sie vor Änderungen an Dateien die ausdrückliche Zustimmung des Benutzers ein.

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "recoup-platform-email-helper" from https://skillstore.io/skills/recoupable-recoup-platform-email-helper.md and its manifest at https://skillstore.io/api/skills/recoupable-recoup-platform-email-helper/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/recoupable-recoup-platform-email-helper.md Signiertes manifest GET /api/skills/recoupable-recoup-platform-email-helper/manifest Signiertes lockfile GET /api/skills/recoupable-recoup-platform-email-helper/lockfile

Testen

„recoup-platform-email-helper“ wird verwendet. Preview a weekly report email for the account owner.

Erwartetes Ergebnis:

Dry run prepared for the Recoup email endpoint. Subject: Weekly Report. The validated HTML body is present, and no message was sent.

„recoup-platform-email-helper“ wird verwendet. Send the completed campaign summary to the approved recipient.

Erwartetes Ergebnis:

The campaign summary was sent successfully. The service returned message identifier email_4821.

„recoup-platform-email-helper“ wird verwendet. Send a notification without a message body.

Erwartetes Ergebnis:

The email was not sent because a non-empty HTML or plain-text body is required.

Sicherheitsaudit

Hohes Risiko

v1 • 10.8.2026 Versionsbericht öffnen

Most static findings are false positives caused by Markdown backticks, comments, and JavaScript template literals. The review confirms outbound email delivery, sensitive credential use, unrestricted local file reads, and an environment-configurable authenticated endpoint. Predictable temporary paths in the documentation also create integrity risk.

Gescannte Dateien

175

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (2)

Hoch

scripts/send-email.mjs:83-84 scripts/send-email.mjs:92-102

Configurable Endpoint Can Receive Bearer Credentials

RECOUP_API_BASE controls the destination while the request includes the Recoup bearer credential and email body. A modified environment can redirect both.

The data flow is direct: an environment-controlled base URL receives a request containing the environment-sourced bearer token and serialized email content.

Hoch

scripts/send-email.mjs:50-52 scripts/send-email.mjs:79-102

Arbitrary Local File Content Can Be Sent Externally

Caller-selected HTML or text files are read without path restrictions, serialized into the email payload, and transmitted to configured recipients.

The script directly maps caller-provided file paths into payload fields and sends the resulting payload through fetch without path or content controls.

Elemente der Fähigkeitsprüfung (11)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

scripts/send-email.mjs:92

Generic API/secret keys

const key = process.env.RECOUP_API_KEY || process.env.RECOUP_ACCESS_TOKEN;

The script reads a Recoup API credential and later places it in an Authorization header. This is necessary but materially sensitive behavior.

Mittel

scripts/send-email.mjs:50

Synchronous file operations

case "html-file": out.html = readFileSync(val, "utf8"); break;

The script synchronously reads a caller-selected path as email content. That content can later leave the system through the email API.

Mittel

scripts/send-email.mjs:52

Synchronous file operations

case "text-file": out.text = readFileSync(val, "utf8"); break;

The script synchronously reads a caller-selected path as email content. That content can later leave the system through the email API.

Mittel

SKILL.md:19

Temp directory access

cat > /tmp/report.html <<'HTML'

The example writes email content to a predictable shared /tmp path. Existing files or symbolic links at that path could be overwritten.

Mittel

SKILL.md:30

Temp directory access

--html-file /tmp/report.html \

The example reads email content from a predictable shared /tmp path. Another process could replace that content before it is sent.

Niedrig

scripts/send-email.mjs:99

Fetch API call

res = await fetch(url, {

The script performs an outbound POST containing email content and an authorization header. This intended network action can disclose data if its destination is misconfigured.

Niedrig

scripts/send-email.mjs:83

Hardcoded URL

const base = process.env.RECOUP_API_BASE || "https://api.recoupable.dev";

The hardcoded Recoup domain is the default destination for email content and credentials. This is disclosed functionality, but it is still an external data transfer.

Niedrig

scripts/send-email.mjs:83

Environment variable access (dot notation)

const base = process.env.RECOUP_API_BASE || "https://api.recoupable.dev";

The script reads RECOUP_API_BASE to choose the authenticated request destination. A modified value can redirect email content and credentials.

Niedrig

scripts/send-email.mjs:92

Environment variable access (dot notation)

const key = process.env.RECOUP_API_KEY || process.env.RECOUP_ACCESS_TOKEN;

The script reads a Recoup API credential and later places it in an Authorization header. This is necessary but materially sensitive behavior.

Niedrig

scripts/send-email.mjs:83

Environment variable object

const base = process.env.RECOUP_API_BASE || "https://api.recoupable.dev";

The script reads RECOUP_API_BASE to choose the authenticated request destination. A modified value can redirect email content and credentials.

Niedrig

scripts/send-email.mjs:92

Environment variable object

const key = process.env.RECOUP_API_KEY || process.env.RECOUP_ACCESS_TOKEN;

The script reads a Recoup API credential and later places it in an Authorization header. This is necessary but materially sensitive behavior.

Risikofaktoren

⚙️ Externe Befehle (35)

🌐 Netzwerkzugriff (3)

scripts/send-email.mjs:99 scripts/send-email.mjs:26 scripts/send-email.mjs:83

📁 Dateisystemzugriff (8)

scripts/send-email.mjs:28 scripts/send-email.mjs:50 scripts/send-email.mjs:52 scripts/send-email.mjs:12 SKILL.md:34 SKILL.md:34 SKILL.md:19 SKILL.md:30

🔑 Umgebungsvariablen (8)

scripts/send-email.mjs:83 scripts/send-email.mjs:92 scripts/send-email.mjs:83 scripts/send-email.mjs:92 scripts/send-email.mjs:25 scripts/send-email.mjs:92 scripts/send-email.mjs:93 SKILL.md:52

Geprüft von: codex

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/recoupable-recoup-platform-email-helper/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/recoupable-recoup-platform-email-helper/security.svg)](https://skillstore.io/skills/recoupable-recoup-platform-email-helper?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/recoupable-recoup-platform-email-helper?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/recoupable-recoup-platform-email-helper/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/recoupable-recoup-platform-email-helper.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

recoupable. (2026). recoup-platform-email-helper security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/recoupable-recoup-platform-email-helper/audits/1

BibTeX-Zitat

@techreport{recoupable-recoupable-recoup-platform-email-helper-2026,
  author = {recoupable},
  title = {recoup-platform-email-helper security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/recoupable-recoup-platform-email-helper/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "recoup-platform-email-helper security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "recoupable"
date-released: "2026-08-10"
url: "https://skillstore.io/skills/recoupable-recoup-platform-email-helper/audits/1"
identifiers:
  - type: other
    value: "skillstore:recoupable-recoup-platform-email-helper:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

Wartbarkeit

Inhalt

Gemeinschaft

Spezifikationskonformität

Was Sie erstellen können

Send an Account Report

Deliver a generated HTML performance report to the account owner after previewing the serialized message.

Notify an Operations Team

Send a plain-text task result to several recipients and include relevant carbon-copy contacts.

Deliver Workflow Alerts

Add dependable email delivery to automated tasks with explicit exit codes and API error output.

Diese Prompts ausprobieren

Preview a Simple Email

Prepare a plain-text email with subject [subject] and body [body]. Use dry-run mode and show the preview without sending.

Send an HTML Report

Create an HTML report from [report details], save it to a secure temporary file, preview it, then send it to [recipient].

Notify Multiple Recipients

Send [message] to [recipients], carbon copy [contacts], and include chat identifier [chat ID]. Confirm the final recipient list before sending.

Run a Verified Delivery Workflow

Generate [report], preview the exact payload, verify the approved Recoup endpoint and recipients, send it, then report the message identifier or failure.

Bewährte Praktiken

Use dry-run mode to inspect the endpoint, recipients, subject, and body before every important send.
Use unique files with restrictive permissions and remove them after delivery.
Confirm recipients and the trusted Recoup endpoint before sending sensitive content.

Vermeiden

Do not build email payloads with shell interpolation or inline JSON quoting.
Do not pass secrets, unrelated local files, or unapproved recipient addresses.
Do not report success when the helper returns a nonzero exit code.

Häufig gestellte Fragen

Which message formats are supported?

The helper supports HTML and plain-text bodies supplied directly or read from local files.

Can I preview an email without sending it?

Yes. Dry-run mode validates the body and prints the target and serialized payload without making a network request.

Which credentials are required?

Live sending requires RECOUP_API_KEY or RECOUP_ACCESS_TOKEN in the environment. Dry-run mode does not require either credential.

What happens when no recipient is supplied?

The Recoup API defaults delivery to the account email associated with the credential.

Does the helper prevent empty emails?

Yes. It exits with an error unless the HTML or plain-text body contains non-whitespace content.

Does it support attachments or scheduled delivery?

No. The helper only sends HTML or plain-text messages with recipients, carbon copies, subjects, and optional chat identifiers.

Entwicklerdetails

Autor

recoupable

Lizenz

MIT

Skillstore-Revision

Versionshinweis

Der Autor hat keine Version angegeben.

Repository

https://github.com/recoupable/skills/tree/00aa5c25a305b1056602bdf1dcf4c904073e6d55/skills/recoup-platform-email-helper

Ref.

c0756f573f674ae8ef8b62fdfe93dea11b4d2578

Aktualität der Wartung

11.8.2026

Nutzung

0 Downloads · 0 Aufrufe

Dateistruktur

📁 scripts/

📄 send-email.mjs

📄 SKILL.md