Habilidades recoup-platform-build-os

📦

recoup-platform-build-os

Name: recoup-platform-build-os
Author: recoupable

Revisión del contenido r1 Riesgo alto ⚙️ Comandos externos📁 Acceso al sistema de archivos🌐 Acceso a red🔑 Variables de entorno

Build a Recoup Label Workspace OS

Label knowledge, roster data, and recurring work often become fragmented across tools. This skill builds a structured workspace connected to Recoup workflows.

Compatible con: Claude Codex Code(CC)

⚠️ 38 Deficiente

Detente y solicita confirmación antes de instalar.

Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "recoup-platform-build-os" from https://skillstore.io/skills/recoupable-recoup-platform-build-os.md and its manifest at https://skillstore.io/api/skills/recoupable-recoup-platform-build-os/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/recoupable-recoup-platform-build-os.md Manifest firmado GET /api/skills/recoupable-recoup-platform-build-os/manifest Lockfile firmado GET /api/skills/recoupable-recoup-platform-build-os/lockfile

Pruébalo

Usando "recoup-platform-build-os". Build a workspace from our roster export, release notes, and label operating documents.

Resultado esperado:

Understanding brief covering the label, roster, release lifecycle, recurring work, and assumptions.
Structured artist, release, knowledge, work, artifact, plugin, and operations areas.
Health report listing completed checks, unresolved facts, and recommended next actions.

Usando "recoup-platform-build-os". Turn our repeated release review process into a reusable label skill.

Resultado esperado:

A staged skill proposal with clear triggers, provenance, workflow steps, and verification evidence.
A review request before publication into the label plugin.
An updated package plan after approval.

Usando "recoup-platform-build-os". Check whether our label workspace is current and internally consistent.

Resultado esperado:

A scored health report covering roster folders, release state, manifests, skill reachability, package freshness, and maintenance scheduling.

Auditoría de seguridad

Riesgo alto

v1 • 10/8/2026 Abrir el informe versionado

Most static findings are false positives caused by Markdown code spans, documented project paths, and read-only workspace checks. Confirmed risks include persistent scheduled agent execution, predictable temporary archive paths, and access to a user-scoped credential file. The provided schedule can commit and push broad repository changes unattended.

Archivos escaneados

2,363

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (4)

Alto

assets/janitor-schedule.tmpl:38

Cron job modification

`crontab -e`, then (adjust the path + your agent CLI):

The template explicitly instructs users to edit crontab and schedule an agent workflow. This establishes persistent unattended execution.

Alto

assets/janitor-schedule.tmpl:45

macOS launch agent/daemon

Save as `~/Library/LaunchAgents/local.{DOMAIN_SLUG}.janitor.plist`, then `launchctl load` it:

The template creates and loads a LaunchAgent that survives reboots and runs an agent command weekly. This is an explicit persistence mechanism.

Alto

SKILL.md:44

Environment file access

ignores `.env`. Real credentials live outside the repo (env vars / `~/.claude/recoup.env`); never

The skill points companion authentication workflows to ~/.claude/recoup.env, a user-scoped file expected to contain live credentials. Access is sensitive despite legitimate intent.

Alto

assets/janitor-schedule.tmpl:27-34 assets/janitor-SKILL.md.tmpl:12-20

Unattended Broad Repository Commit and Push

The scheduled janitor example stages every repository change, commits it, and pushes without review after an autonomous agent run. Untracked secrets or unintended edits could leave the machine.

The schedule directly uses git add -A, commit, and push after invoking an editing agent. The janitor instructions authorize broad automatic workspace changes.

Elementos de revisión de capacidades (7)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Alto

assets/janitor-schedule.tmpl:53

Unix shell invocation

The launchd template invokes /bin/sh -c with a placeholder agent command. Enabling it creates recurring shell execution with the agent's permissions.

Alto

SKILL.md:44

Hidden file in home directory

ignores `.env`. Real credentials live outside the repo (env vars / `~/.claude/recoup.env`); never

The skill identifies ~/.claude/recoup.env as a credential source that companion authentication workflows may load. This is deliberate access to sensitive user-scoped storage.

Medio

references/packaging.md:125

Temp directory access

cd {workspace}/plugin && zip -rq /tmp/{DOMAIN_SLUG}-os.plugin . -x "*.DS_Store"

Packaging writes to a predictable /tmp filename before copying it. A preexisting link or concurrent build could redirect or corrupt the artifact.

Medio

references/packaging.md:126

Temp directory access

cp /tmp/{DOMAIN_SLUG}-os.plugin {OUTPUTS}/{DOMAIN_SLUG}-os.plugin

Packaging writes to a predictable /tmp filename before copying it. A preexisting link or concurrent build could redirect or corrupt the artifact.

Medio

references/packaging.md:141

Temp directory access

cd {workspace}/plugin && zip -rq /tmp/{DOMAIN_SLUG}-os.plugin . -x "*.DS_Store"

Packaging writes to a predictable /tmp filename before copying it. A preexisting link or concurrent build could redirect or corrupt the artifact.

Medio

references/packaging.md:142

Temp directory access

cp /tmp/{DOMAIN_SLUG}-os.plugin {OUTPUTS}/{DOMAIN_SLUG}-os.plugin

Packaging writes to a predictable /tmp filename before copying it. A preexisting link or concurrent build could redirect or corrupt the artifact.

Medio

SKILL.md:44

Hidden file access

ignores `.env`. Real credentials live outside the repo (env vars / `~/.claude/recoup.env`); never

The skill identifies ~/.claude/recoup.env as a credential source that companion authentication workflows may load. This is deliberate access to sensitive user-scoped storage.

Factores de riesgo

⚙️ Comandos externos (50)

📁 Acceso al sistema de archivos (50)

🌐 Acceso a red (1)

assets/janitor-schedule.tmpl:49

🔑 Variables de entorno (4)

assets/janitor-schedule.tmpl:24 references/blueprint.md:11 SKILL.md:42 SKILL.md:49

Patrones detectados

Cron job modificationmacOS launch agent/daemon

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/recoupable-recoup-platform-build-os/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/recoupable-recoup-platform-build-os/security.svg)](https://skillstore.io/skills/recoupable-recoup-platform-build-os?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/recoupable-recoup-platform-build-os?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/recoupable-recoup-platform-build-os/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/recoupable-recoup-platform-build-os.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

recoupable. (2026). recoup-platform-build-os security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/recoupable-recoup-platform-build-os/audits/1

Cita BibTeX

@techreport{recoupable-recoupable-recoup-platform-build-os-2026,
  author = {recoupable},
  title = {recoup-platform-build-os security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/recoupable-recoup-platform-build-os/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "recoup-platform-build-os security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "recoupable"
date-released: "2026-08-10"
url: "https://skillstore.io/skills/recoupable-recoup-platform-build-os/audits/1"
identifiers:
  - type: other
    value: "skillstore:recoupable-recoup-platform-build-os:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Launch a Label Workspace

Create a structured operating repository from label notes, roster data, and existing project files.

Mirror a Live Roster

Connect Recoup and create consistent artist identity and release folders from the current account.

Standardize Agent Operations

Package label-specific maintenance and knowledge workflows for Claude, Codex, and Claude Code.

Prueba estos prompts

Create the Workspace

Build our label workspace in this repository using the available kickoff files. Show assumptions before connecting Recoup.

Mirror the Roster

Connect our Recoup account, inventory the roster, and create missing artist folders without overwriting existing material.

Add Maintenance Workflows

Generate the doctor and janitor workflows, run the health check, and explain every proposed automatic repair.

Package and Review Automation

Validate and package the label plugin. Review scheduler permissions, credential access, temporary files, and remote push behavior before enabling anything.

Mejores prácticas

Review the understanding brief and inferred facts before allowing live Recoup changes.
Commit a clean baseline before scaffolding so every generated change is easy to inspect.
Keep scheduled automation disabled until permissions, staged paths, secret handling, and push behavior are reviewed.

Evitar

Do not place real credentials in the repository or generated example files.
Do not run the builder in a repository containing unrelated projects or unreviewed sensitive files.
Do not enable unattended commits, pushes, or external synchronization without narrow scope and approval controls.

Preguntas frecuentes

Does this skill require a Recoup account?

Yes for live roster synchronization. Structural workspace generation can use provided files, but Recoup-backed identity data requires valid account access.

Which agent tools are supported?

The generated workspace includes conventions and plugin manifests for Claude, Codex, Claude Code, and compatible project skill discovery.

Will it overwrite existing artist files?

The workflow instructs agents to skip existing roster folders and reconcile material. Review changes because broad workspace edits remain possible.

Does it enable scheduled maintenance automatically?

No. It provides scheduler templates and requests a recorded cadence. Users must explicitly configure and enable a scheduler.

Where should credentials be stored?

Use approved environment storage outside the shared repository. Keep only variable names in .env.example and confirm access before loading credentials.

How is the generated workspace verified?

A generated doctor checks structure, manifests, skill reachability, package freshness, dashboard presence, and selected consistency rules.