Skills recoup-platform-email-helper

📦

recoup-platform-email-helper

Name: recoup-platform-email-helper
Author: recoupable

Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Send Reliable Emails Through the Recoup API

Shell-built email payloads can break quoting and deliver empty messages. This helper validates content, serializes it safely, previews requests, and reports delivery failures.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "recoup-platform-email-helper" from https://skillstore.io/skills/recoupable-recoup-platform-email-helper.md and its manifest at https://skillstore.io/api/skills/recoupable-recoup-platform-email-helper/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/recoupable-recoup-platform-email-helper.md Signed manifest GET /api/skills/recoupable-recoup-platform-email-helper/manifest Signed lockfile GET /api/skills/recoupable-recoup-platform-email-helper/lockfile

Test it

Using "recoup-platform-email-helper". Preview a weekly report email for the account owner.

Expected outcome:

Dry run prepared for the Recoup email endpoint. Subject: Weekly Report. The validated HTML body is present, and no message was sent.

Using "recoup-platform-email-helper". Send the completed campaign summary to the approved recipient.

Expected outcome:

The campaign summary was sent successfully. The service returned message identifier email_4821.

Using "recoup-platform-email-helper". Send a notification without a message body.

Expected outcome:

The email was not sent because a non-empty HTML or plain-text body is required.

Security Audit

High Risk

v1 • 8/10/2026 Open versioned report

Most static findings are false positives caused by Markdown backticks, comments, and JavaScript template literals. The review confirms outbound email delivery, sensitive credential use, unrestricted local file reads, and an environment-configurable authenticated endpoint. Predictable temporary paths in the documentation also create integrity risk.

Files scanned

175

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

scripts/send-email.mjs:83-84 scripts/send-email.mjs:92-102

Configurable Endpoint Can Receive Bearer Credentials

RECOUP_API_BASE controls the destination while the request includes the Recoup bearer credential and email body. A modified environment can redirect both.

The data flow is direct: an environment-controlled base URL receives a request containing the environment-sourced bearer token and serialized email content.

High

scripts/send-email.mjs:50-52 scripts/send-email.mjs:79-102

Arbitrary Local File Content Can Be Sent Externally

Caller-selected HTML or text files are read without path restrictions, serialized into the email payload, and transmitted to configured recipients.

The script directly maps caller-provided file paths into payload fields and sends the resulting payload through fetch without path or content controls.

Capability review items (11)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/send-email.mjs:92

Generic API/secret keys

const key = process.env.RECOUP_API_KEY || process.env.RECOUP_ACCESS_TOKEN;

The script reads a Recoup API credential and later places it in an Authorization header. This is necessary but materially sensitive behavior.

Medium

scripts/send-email.mjs:50

Synchronous file operations

case "html-file": out.html = readFileSync(val, "utf8"); break;

The script synchronously reads a caller-selected path as email content. That content can later leave the system through the email API.

Medium

scripts/send-email.mjs:52

Synchronous file operations

case "text-file": out.text = readFileSync(val, "utf8"); break;

The script synchronously reads a caller-selected path as email content. That content can later leave the system through the email API.

Medium

SKILL.md:19

Temp directory access

cat > /tmp/report.html <<'HTML'

The example writes email content to a predictable shared /tmp path. Existing files or symbolic links at that path could be overwritten.

Medium

SKILL.md:30

Temp directory access

--html-file /tmp/report.html \

The example reads email content from a predictable shared /tmp path. Another process could replace that content before it is sent.

Low

scripts/send-email.mjs:99

Fetch API call

res = await fetch(url, {

The script performs an outbound POST containing email content and an authorization header. This intended network action can disclose data if its destination is misconfigured.

Low

scripts/send-email.mjs:83

Hardcoded URL

const base = process.env.RECOUP_API_BASE || "https://api.recoupable.dev";

The hardcoded Recoup domain is the default destination for email content and credentials. This is disclosed functionality, but it is still an external data transfer.

Low

scripts/send-email.mjs:83

Environment variable access (dot notation)

const base = process.env.RECOUP_API_BASE || "https://api.recoupable.dev";

The script reads RECOUP_API_BASE to choose the authenticated request destination. A modified value can redirect email content and credentials.

Low

scripts/send-email.mjs:92

Environment variable access (dot notation)

const key = process.env.RECOUP_API_KEY || process.env.RECOUP_ACCESS_TOKEN;

The script reads a Recoup API credential and later places it in an Authorization header. This is necessary but materially sensitive behavior.

Low

scripts/send-email.mjs:83

Environment variable object

const base = process.env.RECOUP_API_BASE || "https://api.recoupable.dev";

The script reads RECOUP_API_BASE to choose the authenticated request destination. A modified value can redirect email content and credentials.

Low

scripts/send-email.mjs:92

Environment variable object

const key = process.env.RECOUP_API_KEY || process.env.RECOUP_ACCESS_TOKEN;

The script reads a Recoup API credential and later places it in an Authorization header. This is necessary but materially sensitive behavior.

Risk Factors

⚙️ External commands (35)

🌐 Network access (3)

scripts/send-email.mjs:99 scripts/send-email.mjs:26 scripts/send-email.mjs:83

📁 Filesystem access (8)

scripts/send-email.mjs:28 scripts/send-email.mjs:50 scripts/send-email.mjs:52 scripts/send-email.mjs:12 SKILL.md:34 SKILL.md:34 SKILL.md:19 SKILL.md:30

🔑 Env variables (8)

scripts/send-email.mjs:83 scripts/send-email.mjs:92 scripts/send-email.mjs:83 scripts/send-email.mjs:92 scripts/send-email.mjs:25 scripts/send-email.mjs:92 scripts/send-email.mjs:93 SKILL.md:52

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/recoupable-recoup-platform-email-helper/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/recoupable-recoup-platform-email-helper/security.svg)](https://skillstore.io/skills/recoupable-recoup-platform-email-helper?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/recoupable-recoup-platform-email-helper?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/recoupable-recoup-platform-email-helper/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/recoupable-recoup-platform-email-helper.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

recoupable. (2026). recoup-platform-email-helper security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/recoupable-recoup-platform-email-helper/audits/1

BibTeX citation

@techreport{recoupable-recoupable-recoup-platform-email-helper-2026,
  author = {recoupable},
  title = {recoup-platform-email-helper security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/recoupable-recoup-platform-email-helper/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "recoup-platform-email-helper security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "recoupable"
date-released: "2026-08-10"
url: "https://skillstore.io/skills/recoupable-recoup-platform-email-helper/audits/1"
identifiers:
  - type: other
    value: "skillstore:recoupable-recoup-platform-email-helper:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Send an Account Report

Deliver a generated HTML performance report to the account owner after previewing the serialized message.

Notify an Operations Team

Send a plain-text task result to several recipients and include relevant carbon-copy contacts.

Deliver Workflow Alerts

Add dependable email delivery to automated tasks with explicit exit codes and API error output.

Try These Prompts

Preview a Simple Email

Prepare a plain-text email with subject [subject] and body [body]. Use dry-run mode and show the preview without sending.

Send an HTML Report

Create an HTML report from [report details], save it to a secure temporary file, preview it, then send it to [recipient].

Notify Multiple Recipients

Send [message] to [recipients], carbon copy [contacts], and include chat identifier [chat ID]. Confirm the final recipient list before sending.

Run a Verified Delivery Workflow

Generate [report], preview the exact payload, verify the approved Recoup endpoint and recipients, send it, then report the message identifier or failure.

Best Practices

Use dry-run mode to inspect the endpoint, recipients, subject, and body before every important send.
Use unique files with restrictive permissions and remove them after delivery.
Confirm recipients and the trusted Recoup endpoint before sending sensitive content.

Avoid

Do not build email payloads with shell interpolation or inline JSON quoting.
Do not pass secrets, unrelated local files, or unapproved recipient addresses.
Do not report success when the helper returns a nonzero exit code.

Frequently Asked Questions

Which message formats are supported?

The helper supports HTML and plain-text bodies supplied directly or read from local files.

Can I preview an email without sending it?

Yes. Dry-run mode validates the body and prints the target and serialized payload without making a network request.

Which credentials are required?

Live sending requires RECOUP_API_KEY or RECOUP_ACCESS_TOKEN in the environment. Dry-run mode does not require either credential.

What happens when no recipient is supplied?

The Recoup API defaults delivery to the account email associated with the credential.

Does the helper prevent empty emails?

Yes. It exits with an error unless the HTML or plain-text body contains non-whitespace content.

Does it support attachments or scheduled delivery?

No. The helper only sends HTML or plain-text messages with recipients, carbon copies, subjects, and optional chat identifiers.

Developer Details

Author

recoupable

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/recoupable/skills/tree/00aa5c25a305b1056602bdf1dcf4c904073e6d55/skills/recoup-platform-email-helper

Ref

c0756f573f674ae8ef8b62fdfe93dea11b4d2578

Maintenance freshness

8/11/2026

Usage

0 downloads · 0 views

File structure

📁 scripts/

📄 send-email.mjs

📄 SKILL.md