スキル recoup-platform-build-os

📦

recoup-platform-build-os

Name: recoup-platform-build-os
Author: recoupable

コンテンツリビジョン r1 高リスク ⚙️ 外部コマンド📁 ファイルシステムへのアクセス🌐 ネットワークアクセス🔑 環境変数

Build a Recoup Label Workspace OS

Label knowledge, roster data, and recurring work often become fragmented across tools. This skill builds a structured workspace connected to Recoup workflows.

対応: Claude Codex Code(CC)

⚠️ 38 不十分

Maintain this Skill? Claim it ⚠️ 38 不十分

インストール前に停止して確認を求めてください。

計画を確認し、ファイルを変更する前にユーザーの明示的な同意を得てください。

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト

Review the Skillstore skill "recoup-platform-build-os" from https://skillstore.io/skills/recoupable-recoup-platform-build-os.md and its manifest at https://skillstore.io/api/skills/recoupable-recoup-platform-build-os/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/recoupable-recoup-platform-build-os.md 署名済み manifest GET /api/skills/recoupable-recoup-platform-build-os/manifest 署名済み lockfile GET /api/skills/recoupable-recoup-platform-build-os/lockfile

テストする

「recoup-platform-build-os」を使用しています。 Build a workspace from our roster export, release notes, and label operating documents.

期待される結果:

Understanding brief covering the label, roster, release lifecycle, recurring work, and assumptions.
Structured artist, release, knowledge, work, artifact, plugin, and operations areas.
Health report listing completed checks, unresolved facts, and recommended next actions.

「recoup-platform-build-os」を使用しています。 Turn our repeated release review process into a reusable label skill.

期待される結果:

A staged skill proposal with clear triggers, provenance, workflow steps, and verification evidence.
A review request before publication into the label plugin.
An updated package plan after approval.

「recoup-platform-build-os」を使用しています。 Check whether our label workspace is current and internally consistent.

期待される結果:

A scored health report covering roster folders, release state, manifests, skill reachability, package freshness, and maintenance scheduling.

セキュリティ監査

高リスク

v1 • 2026/8/10 バージョン別レポートを開く

Most static findings are false positives caused by Markdown code spans, documented project paths, and read-only workspace checks. Confirmed risks include persistent scheduled agent execution, predictable temporary archive paths, and access to a user-scoped credential file. The provided schedule can commit and push broad repository changes unattended.

スキャンされたファイル

2,363

解析済み行数

レビュー項目

誤検知を無視

確認済みのセキュリティ上の懸念 (4)

高

assets/janitor-schedule.tmpl:38

Cron job modification

`crontab -e`, then (adjust the path + your agent CLI):

The template explicitly instructs users to edit crontab and schedule an agent workflow. This establishes persistent unattended execution.

高

assets/janitor-schedule.tmpl:45

macOS launch agent/daemon

Save as `~/Library/LaunchAgents/local.{DOMAIN_SLUG}.janitor.plist`, then `launchctl load` it:

The template creates and loads a LaunchAgent that survives reboots and runs an agent command weekly. This is an explicit persistence mechanism.

高

SKILL.md:44

Environment file access

ignores `.env`. Real credentials live outside the repo (env vars / `~/.claude/recoup.env`); never

The skill points companion authentication workflows to ~/.claude/recoup.env, a user-scoped file expected to contain live credentials. Access is sensitive despite legitimate intent.

高

assets/janitor-schedule.tmpl:27-34 assets/janitor-SKILL.md.tmpl:12-20

Unattended Broad Repository Commit and Push

The scheduled janitor example stages every repository change, commits it, and pushes without review after an autonomous agent run. Untracked secrets or unintended edits could leave the machine.

The schedule directly uses git add -A, commit, and push after invoking an editing agent. The janitor instructions authorize broad automatic workspace changes.

機能レビュー項目 (7)

これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。

高

assets/janitor-schedule.tmpl:53

Unix shell invocation

The launchd template invokes /bin/sh -c with a placeholder agent command. Enabling it creates recurring shell execution with the agent's permissions.

高

SKILL.md:44

Hidden file in home directory

ignores `.env`. Real credentials live outside the repo (env vars / `~/.claude/recoup.env`); never

The skill identifies ~/.claude/recoup.env as a credential source that companion authentication workflows may load. This is deliberate access to sensitive user-scoped storage.

中

references/packaging.md:125

Temp directory access

cd {workspace}/plugin && zip -rq /tmp/{DOMAIN_SLUG}-os.plugin . -x "*.DS_Store"

Packaging writes to a predictable /tmp filename before copying it. A preexisting link or concurrent build could redirect or corrupt the artifact.

中

references/packaging.md:126

Temp directory access

cp /tmp/{DOMAIN_SLUG}-os.plugin {OUTPUTS}/{DOMAIN_SLUG}-os.plugin

Packaging writes to a predictable /tmp filename before copying it. A preexisting link or concurrent build could redirect or corrupt the artifact.

中

references/packaging.md:141

Temp directory access

cd {workspace}/plugin && zip -rq /tmp/{DOMAIN_SLUG}-os.plugin . -x "*.DS_Store"

Packaging writes to a predictable /tmp filename before copying it. A preexisting link or concurrent build could redirect or corrupt the artifact.

中

references/packaging.md:142

Temp directory access

cp /tmp/{DOMAIN_SLUG}-os.plugin {OUTPUTS}/{DOMAIN_SLUG}-os.plugin

Packaging writes to a predictable /tmp filename before copying it. A preexisting link or concurrent build could redirect or corrupt the artifact.

中

SKILL.md:44

Hidden file access

ignores `.env`. Real credentials live outside the repo (env vars / `~/.claude/recoup.env`); never

The skill identifies ~/.claude/recoup.env as a credential source that companion authentication workflows may load. This is deliberate access to sensitive user-scoped storage.

リスク要因

⚙️ 外部コマンド (50)

📁 ファイルシステムへのアクセス (50)

🌐 ネットワークアクセス (1)

assets/janitor-schedule.tmpl:49

🔑 環境変数 (4)

assets/janitor-schedule.tmpl:24 references/blueprint.md:11 SKILL.md:42 SKILL.md:49

検出されたパターン

Cron job modificationmacOS launch agent/daemon

監査者: codex

このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く

レポートリンクをコピー

https://skillstore.io/skills/recoupable-recoup-platform-build-os/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/recoupable-recoup-platform-build-os/security.svg)](https://skillstore.io/skills/recoupable-recoup-platform-build-os?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/recoupable-recoup-platform-build-os?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/recoupable-recoup-platform-build-os/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/recoupable-recoup-platform-build-os.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学術引用 (APA · BibTeX · CFF)

APA形式の引用

recoupable. (2026). recoup-platform-build-os security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/recoupable-recoup-platform-build-os/audits/1

BibTeX形式の引用

@techreport{recoupable-recoupable-recoup-platform-build-os-2026,
  author = {recoupable},
  title = {recoup-platform-build-os security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/recoupable-recoup-platform-build-os/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "recoup-platform-build-os security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "recoupable"
date-released: "2026-08-10"
url: "https://skillstore.io/skills/recoupable-recoup-platform-build-os/audits/1"
identifiers:
  - type: other
    value: "skillstore:recoupable-recoup-platform-build-os:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore スコア

このスコアの理由証拠の信頼度: 中

アーキテクチャ

保守性

コンテンツ

コミュニティ

仕様準拠

作成できるもの

Launch a Label Workspace

Create a structured operating repository from label notes, roster data, and existing project files.

Mirror a Live Roster

Connect Recoup and create consistent artist identity and release folders from the current account.

Standardize Agent Operations

Package label-specific maintenance and knowledge workflows for Claude, Codex, and Claude Code.

これらのプロンプトを試す

Create the Workspace

Build our label workspace in this repository using the available kickoff files. Show assumptions before connecting Recoup.

Mirror the Roster

Connect our Recoup account, inventory the roster, and create missing artist folders without overwriting existing material.

Add Maintenance Workflows

Generate the doctor and janitor workflows, run the health check, and explain every proposed automatic repair.

Package and Review Automation

Validate and package the label plugin. Review scheduler permissions, credential access, temporary files, and remote push behavior before enabling anything.

ベストプラクティス

Review the understanding brief and inferred facts before allowing live Recoup changes.
Commit a clean baseline before scaffolding so every generated change is easy to inspect.
Keep scheduled automation disabled until permissions, staged paths, secret handling, and push behavior are reviewed.

回避

Do not place real credentials in the repository or generated example files.
Do not run the builder in a repository containing unrelated projects or unreviewed sensitive files.
Do not enable unattended commits, pushes, or external synchronization without narrow scope and approval controls.

よくある質問

Does this skill require a Recoup account?

Yes for live roster synchronization. Structural workspace generation can use provided files, but Recoup-backed identity data requires valid account access.

Which agent tools are supported?

The generated workspace includes conventions and plugin manifests for Claude, Codex, Claude Code, and compatible project skill discovery.

Will it overwrite existing artist files?

The workflow instructs agents to skip existing roster folders and reconcile material. Review changes because broad workspace edits remain possible.

Does it enable scheduled maintenance automatically?

No. It provides scheduler templates and requests a recorded cadence. Users must explicitly configure and enable a scheduler.

Where should credentials be stored?

Use approved environment storage outside the shared repository. Keep only variable names in .env.example and confirm access before loading credentials.

How is the generated workspace verified?

A generated doctor checks structure, manifests, skill reachability, package freshness, dashboard presence, and selected consistency rules.