Compétences recoup-platform-build-os

📦

recoup-platform-build-os

Name: recoup-platform-build-os
Author: recoupable

Révision du contenu r1 Risque élevé ⚙️ Commandes externes📁 Accès au système de fichiers🌐 Accès réseau🔑 Variables d’environnement

Build a Recoup Label Workspace OS

Label knowledge, roster data, and recurring work often become fragmented across tools. This skill builds a structured workspace connected to Recoup workflows.

Prend en charge: Claude Codex Code(CC)

⚠️ 38 Médiocre

Maintain this Skill? Claim it ⚠️ 38 Médiocre

Arrêtez-vous et demandez confirmation avant l’installation.

Examinez le plan et obtenez le consentement explicite de l’utilisateur avant de modifier des fichiers.

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "recoup-platform-build-os" from https://skillstore.io/skills/recoupable-recoup-platform-build-os.md and its manifest at https://skillstore.io/api/skills/recoupable-recoup-platform-build-os/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/recoupable-recoup-platform-build-os.md manifest signé GET /api/skills/recoupable-recoup-platform-build-os/manifest lockfile signé GET /api/skills/recoupable-recoup-platform-build-os/lockfile

Tester

Utilisation de « recoup-platform-build-os ». Build a workspace from our roster export, release notes, and label operating documents.

Résultat attendu:

Understanding brief covering the label, roster, release lifecycle, recurring work, and assumptions.
Structured artist, release, knowledge, work, artifact, plugin, and operations areas.
Health report listing completed checks, unresolved facts, and recommended next actions.

Utilisation de « recoup-platform-build-os ». Turn our repeated release review process into a reusable label skill.

Résultat attendu:

A staged skill proposal with clear triggers, provenance, workflow steps, and verification evidence.
A review request before publication into the label plugin.
An updated package plan after approval.

Utilisation de « recoup-platform-build-os ». Check whether our label workspace is current and internally consistent.

Résultat attendu:

A scored health report covering roster folders, release state, manifests, skill reachability, package freshness, and maintenance scheduling.

Audit de sécurité

Risque élevé

v1 • 10/08/2026 Ouvrir le rapport versionné

Most static findings are false positives caused by Markdown code spans, documented project paths, and read-only workspace checks. Confirmed risks include persistent scheduled agent execution, predictable temporary archive paths, and access to a user-scoped credential file. The provided schedule can commit and push broad repository changes unattended.

Fichiers analysés

2,363

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (4)

Élevé

assets/janitor-schedule.tmpl:38

Cron job modification

`crontab -e`, then (adjust the path + your agent CLI):

The template explicitly instructs users to edit crontab and schedule an agent workflow. This establishes persistent unattended execution.

Élevé

assets/janitor-schedule.tmpl:45

macOS launch agent/daemon

Save as `~/Library/LaunchAgents/local.{DOMAIN_SLUG}.janitor.plist`, then `launchctl load` it:

The template creates and loads a LaunchAgent that survives reboots and runs an agent command weekly. This is an explicit persistence mechanism.

Élevé

SKILL.md:44

Environment file access

ignores `.env`. Real credentials live outside the repo (env vars / `~/.claude/recoup.env`); never

The skill points companion authentication workflows to ~/.claude/recoup.env, a user-scoped file expected to contain live credentials. Access is sensitive despite legitimate intent.

Élevé

assets/janitor-schedule.tmpl:27-34 assets/janitor-SKILL.md.tmpl:12-20

Unattended Broad Repository Commit and Push

The scheduled janitor example stages every repository change, commits it, and pushes without review after an autonomous agent run. Untracked secrets or unintended edits could leave the machine.

The schedule directly uses git add -A, commit, and push after invoking an editing agent. The janitor instructions authorize broad automatic workspace changes.

Éléments d’évaluation des capacités (7)

Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.

Élevé

assets/janitor-schedule.tmpl:53

Unix shell invocation

The launchd template invokes /bin/sh -c with a placeholder agent command. Enabling it creates recurring shell execution with the agent's permissions.

Élevé

SKILL.md:44

Hidden file in home directory

ignores `.env`. Real credentials live outside the repo (env vars / `~/.claude/recoup.env`); never

The skill identifies ~/.claude/recoup.env as a credential source that companion authentication workflows may load. This is deliberate access to sensitive user-scoped storage.

Moyen

references/packaging.md:125

Temp directory access

cd {workspace}/plugin && zip -rq /tmp/{DOMAIN_SLUG}-os.plugin . -x "*.DS_Store"

Packaging writes to a predictable /tmp filename before copying it. A preexisting link or concurrent build could redirect or corrupt the artifact.

Moyen

references/packaging.md:126

Temp directory access

cp /tmp/{DOMAIN_SLUG}-os.plugin {OUTPUTS}/{DOMAIN_SLUG}-os.plugin

Packaging writes to a predictable /tmp filename before copying it. A preexisting link or concurrent build could redirect or corrupt the artifact.

Moyen

references/packaging.md:141

Temp directory access

cd {workspace}/plugin && zip -rq /tmp/{DOMAIN_SLUG}-os.plugin . -x "*.DS_Store"

Packaging writes to a predictable /tmp filename before copying it. A preexisting link or concurrent build could redirect or corrupt the artifact.

Moyen

references/packaging.md:142

Temp directory access

cp /tmp/{DOMAIN_SLUG}-os.plugin {OUTPUTS}/{DOMAIN_SLUG}-os.plugin

Packaging writes to a predictable /tmp filename before copying it. A preexisting link or concurrent build could redirect or corrupt the artifact.

Moyen

SKILL.md:44

Hidden file access

ignores `.env`. Real credentials live outside the repo (env vars / `~/.claude/recoup.env`); never

The skill identifies ~/.claude/recoup.env as a credential source that companion authentication workflows may load. This is deliberate access to sensitive user-scoped storage.

Facteurs de risque

⚙️ Commandes externes (50)

📁 Accès au système de fichiers (50)

🌐 Accès réseau (1)

assets/janitor-schedule.tmpl:49

🔑 Variables d’environnement (4)

assets/janitor-schedule.tmpl:24 references/blueprint.md:11 SKILL.md:42 SKILL.md:49

Motifs détectés

Cron job modificationmacOS launch agent/daemon

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/recoupable-recoup-platform-build-os/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/recoupable-recoup-platform-build-os/security.svg)](https://skillstore.io/skills/recoupable-recoup-platform-build-os?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/recoupable-recoup-platform-build-os?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/recoupable-recoup-platform-build-os/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/recoupable-recoup-platform-build-os.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

recoupable. (2026). recoup-platform-build-os security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/recoupable-recoup-platform-build-os/audits/1

Citation BibTeX

@techreport{recoupable-recoupable-recoup-platform-build-os-2026,
  author = {recoupable},
  title = {recoup-platform-build-os security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/recoupable-recoup-platform-build-os/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "recoup-platform-build-os security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "recoupable"
date-released: "2026-08-10"
url: "https://skillstore.io/skills/recoupable-recoup-platform-build-os/audits/1"
identifiers:
  - type: other
    value: "skillstore:recoupable-recoup-platform-build-os:audit:1"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Launch a Label Workspace

Create a structured operating repository from label notes, roster data, and existing project files.

Mirror a Live Roster

Connect Recoup and create consistent artist identity and release folders from the current account.

Standardize Agent Operations

Package label-specific maintenance and knowledge workflows for Claude, Codex, and Claude Code.

Essayez ces prompts

Create the Workspace

Build our label workspace in this repository using the available kickoff files. Show assumptions before connecting Recoup.

Mirror the Roster

Connect our Recoup account, inventory the roster, and create missing artist folders without overwriting existing material.

Add Maintenance Workflows

Generate the doctor and janitor workflows, run the health check, and explain every proposed automatic repair.

Package and Review Automation

Validate and package the label plugin. Review scheduler permissions, credential access, temporary files, and remote push behavior before enabling anything.

Bonnes pratiques

Review the understanding brief and inferred facts before allowing live Recoup changes.
Commit a clean baseline before scaffolding so every generated change is easy to inspect.
Keep scheduled automation disabled until permissions, staged paths, secret handling, and push behavior are reviewed.

Éviter

Do not place real credentials in the repository or generated example files.
Do not run the builder in a repository containing unrelated projects or unreviewed sensitive files.
Do not enable unattended commits, pushes, or external synchronization without narrow scope and approval controls.

Foire aux questions

Does this skill require a Recoup account?

Yes for live roster synchronization. Structural workspace generation can use provided files, but Recoup-backed identity data requires valid account access.

Which agent tools are supported?

The generated workspace includes conventions and plugin manifests for Claude, Codex, Claude Code, and compatible project skill discovery.

Will it overwrite existing artist files?

The workflow instructs agents to skip existing roster folders and reconcile material. Review changes because broad workspace edits remain possible.

Does it enable scheduled maintenance automatically?

No. It provides scheduler templates and requests a recorded cadence. Users must explicitly configure and enable a scheduler.

Where should credentials be stored?

Use approved environment storage outside the shared repository. Keep only variable names in .env.example and confirm access before loading credentials.

How is the generated workspace verified?

A generated doctor checks structure, manifests, skill reachability, package freshness, dashboard presence, and selected consistency rules.