Habilidades recoup-platform-email-helper

📦

recoup-platform-email-helper

Name: recoup-platform-email-helper
Author: recoupable

Revisión del contenido r1 Riesgo alto ⚙️ Comandos externos🌐 Acceso a red📁 Acceso al sistema de archivos🔑 Variables de entorno

Send Reliable Emails Through the Recoup API

Shell-built email payloads can break quoting and deliver empty messages. This helper validates content, serializes it safely, previews requests, and reports delivery failures.

Compatible con: Claude Codex Code(CC)

⚠️ 38 Deficiente

Detente y solicita confirmación antes de instalar.

Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "recoup-platform-email-helper" from https://skillstore.io/skills/recoupable-recoup-platform-email-helper.md and its manifest at https://skillstore.io/api/skills/recoupable-recoup-platform-email-helper/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/recoupable-recoup-platform-email-helper.md Manifest firmado GET /api/skills/recoupable-recoup-platform-email-helper/manifest Lockfile firmado GET /api/skills/recoupable-recoup-platform-email-helper/lockfile

Pruébalo

Usando "recoup-platform-email-helper". Preview a weekly report email for the account owner.

Resultado esperado:

Dry run prepared for the Recoup email endpoint. Subject: Weekly Report. The validated HTML body is present, and no message was sent.

Usando "recoup-platform-email-helper". Send the completed campaign summary to the approved recipient.

Resultado esperado:

The campaign summary was sent successfully. The service returned message identifier email_4821.

Usando "recoup-platform-email-helper". Send a notification without a message body.

Resultado esperado:

The email was not sent because a non-empty HTML or plain-text body is required.

Auditoría de seguridad

Riesgo alto

v1 • 10/8/2026 Abrir el informe versionado

Most static findings are false positives caused by Markdown backticks, comments, and JavaScript template literals. The review confirms outbound email delivery, sensitive credential use, unrestricted local file reads, and an environment-configurable authenticated endpoint. Predictable temporary paths in the documentation also create integrity risk.

Archivos escaneados

175

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (2)

Alto

scripts/send-email.mjs:83-84 scripts/send-email.mjs:92-102

Configurable Endpoint Can Receive Bearer Credentials

RECOUP_API_BASE controls the destination while the request includes the Recoup bearer credential and email body. A modified environment can redirect both.

The data flow is direct: an environment-controlled base URL receives a request containing the environment-sourced bearer token and serialized email content.

Alto

scripts/send-email.mjs:50-52 scripts/send-email.mjs:79-102

Arbitrary Local File Content Can Be Sent Externally

Caller-selected HTML or text files are read without path restrictions, serialized into the email payload, and transmitted to configured recipients.

The script directly maps caller-provided file paths into payload fields and sends the resulting payload through fetch without path or content controls.

Elementos de revisión de capacidades (11)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Alto

scripts/send-email.mjs:92

Generic API/secret keys

const key = process.env.RECOUP_API_KEY || process.env.RECOUP_ACCESS_TOKEN;

The script reads a Recoup API credential and later places it in an Authorization header. This is necessary but materially sensitive behavior.

Medio

scripts/send-email.mjs:50

Synchronous file operations

case "html-file": out.html = readFileSync(val, "utf8"); break;

The script synchronously reads a caller-selected path as email content. That content can later leave the system through the email API.

Medio

scripts/send-email.mjs:52

Synchronous file operations

case "text-file": out.text = readFileSync(val, "utf8"); break;

The script synchronously reads a caller-selected path as email content. That content can later leave the system through the email API.

Medio

SKILL.md:19

Temp directory access

cat > /tmp/report.html <<'HTML'

The example writes email content to a predictable shared /tmp path. Existing files or symbolic links at that path could be overwritten.

Medio

SKILL.md:30

Temp directory access

--html-file /tmp/report.html \

The example reads email content from a predictable shared /tmp path. Another process could replace that content before it is sent.

Bajo

scripts/send-email.mjs:99

Fetch API call

res = await fetch(url, {

The script performs an outbound POST containing email content and an authorization header. This intended network action can disclose data if its destination is misconfigured.

Bajo

scripts/send-email.mjs:83

Hardcoded URL

const base = process.env.RECOUP_API_BASE || "https://api.recoupable.dev";

The hardcoded Recoup domain is the default destination for email content and credentials. This is disclosed functionality, but it is still an external data transfer.

Bajo

scripts/send-email.mjs:83

Environment variable access (dot notation)

const base = process.env.RECOUP_API_BASE || "https://api.recoupable.dev";

The script reads RECOUP_API_BASE to choose the authenticated request destination. A modified value can redirect email content and credentials.

Bajo

scripts/send-email.mjs:92

Environment variable access (dot notation)

const key = process.env.RECOUP_API_KEY || process.env.RECOUP_ACCESS_TOKEN;

The script reads a Recoup API credential and later places it in an Authorization header. This is necessary but materially sensitive behavior.

Bajo

scripts/send-email.mjs:83

Environment variable object

const base = process.env.RECOUP_API_BASE || "https://api.recoupable.dev";

The script reads RECOUP_API_BASE to choose the authenticated request destination. A modified value can redirect email content and credentials.

Bajo

scripts/send-email.mjs:92

Environment variable object

const key = process.env.RECOUP_API_KEY || process.env.RECOUP_ACCESS_TOKEN;

The script reads a Recoup API credential and later places it in an Authorization header. This is necessary but materially sensitive behavior.

Factores de riesgo

⚙️ Comandos externos (35)

🌐 Acceso a red (3)

scripts/send-email.mjs:99 scripts/send-email.mjs:26 scripts/send-email.mjs:83

📁 Acceso al sistema de archivos (8)

scripts/send-email.mjs:28 scripts/send-email.mjs:50 scripts/send-email.mjs:52 scripts/send-email.mjs:12 SKILL.md:34 SKILL.md:34 SKILL.md:19 SKILL.md:30

🔑 Variables de entorno (8)

scripts/send-email.mjs:83 scripts/send-email.mjs:92 scripts/send-email.mjs:83 scripts/send-email.mjs:92 scripts/send-email.mjs:25 scripts/send-email.mjs:92 scripts/send-email.mjs:93 SKILL.md:52

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/recoupable-recoup-platform-email-helper/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/recoupable-recoup-platform-email-helper/security.svg)](https://skillstore.io/skills/recoupable-recoup-platform-email-helper?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/recoupable-recoup-platform-email-helper?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/recoupable-recoup-platform-email-helper/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/recoupable-recoup-platform-email-helper.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

recoupable. (2026). recoup-platform-email-helper security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/recoupable-recoup-platform-email-helper/audits/1

Cita BibTeX

@techreport{recoupable-recoupable-recoup-platform-email-helper-2026,
  author = {recoupable},
  title = {recoup-platform-email-helper security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/recoupable-recoup-platform-email-helper/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "recoup-platform-email-helper security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "recoupable"
date-released: "2026-08-10"
url: "https://skillstore.io/skills/recoupable-recoup-platform-email-helper/audits/1"
identifiers:
  - type: other
    value: "skillstore:recoupable-recoup-platform-email-helper:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Send an Account Report

Deliver a generated HTML performance report to the account owner after previewing the serialized message.

Notify an Operations Team

Send a plain-text task result to several recipients and include relevant carbon-copy contacts.

Deliver Workflow Alerts

Add dependable email delivery to automated tasks with explicit exit codes and API error output.

Prueba estos prompts

Preview a Simple Email

Prepare a plain-text email with subject [subject] and body [body]. Use dry-run mode and show the preview without sending.

Send an HTML Report

Create an HTML report from [report details], save it to a secure temporary file, preview it, then send it to [recipient].

Notify Multiple Recipients

Send [message] to [recipients], carbon copy [contacts], and include chat identifier [chat ID]. Confirm the final recipient list before sending.

Run a Verified Delivery Workflow

Generate [report], preview the exact payload, verify the approved Recoup endpoint and recipients, send it, then report the message identifier or failure.

Mejores prácticas

Use dry-run mode to inspect the endpoint, recipients, subject, and body before every important send.
Use unique files with restrictive permissions and remove them after delivery.
Confirm recipients and the trusted Recoup endpoint before sending sensitive content.

Evitar

Do not build email payloads with shell interpolation or inline JSON quoting.
Do not pass secrets, unrelated local files, or unapproved recipient addresses.
Do not report success when the helper returns a nonzero exit code.

Preguntas frecuentes

Which message formats are supported?

The helper supports HTML and plain-text bodies supplied directly or read from local files.

Can I preview an email without sending it?

Yes. Dry-run mode validates the body and prints the target and serialized payload without making a network request.

Which credentials are required?

Live sending requires RECOUP_API_KEY or RECOUP_ACCESS_TOKEN in the environment. Dry-run mode does not require either credential.

What happens when no recipient is supplied?

The Recoup API defaults delivery to the account email associated with the credential.

Does the helper prevent empty emails?

Yes. It exits with an error unless the HTML or plain-text body contains non-whitespace content.

Does it support attachments or scheduled delivery?

No. The helper only sends HTML or plain-text messages with recipients, carbon copies, subjects, and optional chat identifiers.

Detalles del desarrollador

Autor

recoupable

Licencia

MIT

Revisión de Skillstore

Aviso de versión

El autor no declaró una versión.

Repositorio

https://github.com/recoupable/skills/tree/00aa5c25a305b1056602bdf1dcf4c904073e6d55/skills/recoup-platform-email-helper

Ref.

c0756f573f674ae8ef8b62fdfe93dea11b4d2578

Actualidad del mantenimiento

11/8/2026

Uso

0 descargas · 0 vistas

Estructura de archivos

📁 scripts/

📄 send-email.mjs

📄 SKILL.md