技能 recoup-platform-email-helper
📦
recoup-platform-email-helper
内容修订 r1 高风险 ⚙️ 外部命令🌐 网络访问📁 文件系统访问🔑 环境变量
Send Reliable Emails Through the Recoup API
Shell-built email payloads can break quoting and deliver empty messages. This helper validates content, serializes it safely, previews requests, and reports delivery failures.
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "recoup-platform-email-helper" from https://skillstore.io/skills/recoupable-recoup-platform-email-helper.md and its manifest at https://skillstore.io/api/skills/recoupable-recoup-platform-email-helper/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“recoup-platform-email-helper”。 Preview a weekly report email for the account owner.
预期结果:
Dry run prepared for the Recoup email endpoint. Subject: Weekly Report. The validated HTML body is present, and no message was sent.
正在使用“recoup-platform-email-helper”。 Send the completed campaign summary to the approved recipient.
预期结果:
The campaign summary was sent successfully. The service returned message identifier email_4821.
正在使用“recoup-platform-email-helper”。 Send a notification without a message body.
预期结果:
The email was not sent because a non-empty HTML or plain-text body is required.
安全审计
高风险v1 • 2026/8/10 打开版本化报告
Most static findings are false positives caused by Markdown backticks, comments, and JavaScript template literals. The review confirms outbound email delivery, sensitive credential use, unrestricted local file reads, and an environment-configurable authenticated endpoint. Predictable temporary paths in the documentation also create integrity risk.
2
已扫描文件
175
分析行数
11
复核项
0
已忽略误报
已确认安全问题 (2)
高
Configurable Endpoint Can Receive Bearer Credentials
RECOUP_API_BASE controls the destination while the request includes the Recoup bearer credential and email body. A modified environment can redirect both.
The data flow is direct: an environment-controlled base URL receives a request containing the environment-sourced bearer token and serialized email content.
高
Arbitrary Local File Content Can Be Sent Externally
Caller-selected HTML or text files are read without path restrictions, serialized into the email payload, and transmitted to configured recipients.
The script directly maps caller-provided file paths into payload fields and sends the resulting payload through fetch without path or content controls.
能力复核项 (11)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Generic API/secret keys
const key = process.env.RECOUP_API_KEY || process.env.RECOUP_ACCESS_TOKEN;
The script reads a Recoup API credential and later places it in an Authorization header. This is necessary but materially sensitive behavior.
中
Synchronous file operations
case "html-file": out.html = readFileSync(val, "utf8"); break;
The script synchronously reads a caller-selected path as email content. That content can later leave the system through the email API.
中
Synchronous file operations
case "text-file": out.text = readFileSync(val, "utf8"); break;
The script synchronously reads a caller-selected path as email content. That content can later leave the system through the email API.
中
Temp directory access
cat > /tmp/report.html <<'HTML'
The example writes email content to a predictable shared /tmp path. Existing files or symbolic links at that path could be overwritten.
中
Temp directory access
--html-file /tmp/report.html \
The example reads email content from a predictable shared /tmp path. Another process could replace that content before it is sent.
低
Fetch API call
res = await fetch(url, {
The script performs an outbound POST containing email content and an authorization header. This intended network action can disclose data if its destination is misconfigured.
低
Hardcoded URL
const base = process.env.RECOUP_API_BASE || "https://api.recoupable.dev";
The hardcoded Recoup domain is the default destination for email content and credentials. This is disclosed functionality, but it is still an external data transfer.
低
Environment variable access (dot notation)
const base = process.env.RECOUP_API_BASE || "https://api.recoupable.dev";
The script reads RECOUP_API_BASE to choose the authenticated request destination. A modified value can redirect email content and credentials.
低
Environment variable access (dot notation)
const key = process.env.RECOUP_API_KEY || process.env.RECOUP_ACCESS_TOKEN;
The script reads a Recoup API credential and later places it in an Authorization header. This is necessary but materially sensitive behavior.
低
Environment variable object
const base = process.env.RECOUP_API_BASE || "https://api.recoupable.dev";
The script reads RECOUP_API_BASE to choose the authenticated request destination. A modified value can redirect email content and credentials.
低
Environment variable object
const key = process.env.RECOUP_API_KEY || process.env.RECOUP_ACCESS_TOKEN;
The script reads a Recoup API credential and later places it in an Authorization header. This is necessary but materially sensitive behavior.
风险因素
⚙️ 外部命令 (35)
scripts/send-email.mjs:4 scripts/send-email.mjs:5 scripts/send-email.mjs:7 scripts/send-email.mjs:9 scripts/send-email.mjs:57 scripts/send-email.mjs:64 scripts/send-email.mjs:84 scripts/send-email.mjs:88 scripts/send-email.mjs:101 scripts/send-email.mjs:106 scripts/send-email.mjs:112 scripts/send-email.mjs:116 scripts/send-email.mjs:7 scripts/send-email.mjs:7 SKILL.md:3 SKILL.md:12 SKILL.md:18-23 SKILL.md:23-27 SKILL.md:27-32 SKILL.md:32-34 SKILL.md:34 SKILL.md:40-41 SKILL.md:41 SKILL.md:42 SKILL.md:43-44 SKILL.md:44-45 SKILL.md:45-46 SKILL.md:46-50 SKILL.md:50 SKILL.md:52 SKILL.md:53 SKILL.md:12 SKILL.md:29 SKILL.md:12 SKILL.md:27-32
📁 文件系统访问 (8)
审计者: codex
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/recoupable-recoup-platform-email-helper/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/recoupable-recoup-platform-email-helper?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/recoupable-recoup-platform-email-helper?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/recoupable-recoup-platform-email-helper/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/recoupable-recoup-platform-email-helper.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
recoupable. (2026). recoup-platform-email-helper security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/recoupable-recoup-platform-email-helper/audits/1BibTeX 引用
@techreport{recoupable-recoupable-recoup-platform-email-helper-2026,
author = {recoupable},
title = {recoup-platform-email-helper security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/recoupable-recoup-platform-email-helper/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "recoup-platform-email-helper security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "recoupable"
date-released: "2026-08-10"
url: "https://skillstore.io/skills/recoupable-recoup-platform-email-helper/audits/1"
identifiers:
- type: other
value: "skillstore:recoupable-recoup-platform-email-helper:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 45
架构
85
可维护性
87
内容
65
社区
91
规范符合性
你能构建什么
Send an Account Report
Deliver a generated HTML performance report to the account owner after previewing the serialized message.
Notify an Operations Team
Send a plain-text task result to several recipients and include relevant carbon-copy contacts.
Deliver Workflow Alerts
Add dependable email delivery to automated tasks with explicit exit codes and API error output.
试试这些提示
Preview a Simple Email
Prepare a plain-text email with subject [subject] and body [body]. Use dry-run mode and show the preview without sending.
Send an HTML Report
Create an HTML report from [report details], save it to a secure temporary file, preview it, then send it to [recipient].
Notify Multiple Recipients
Send [message] to [recipients], carbon copy [contacts], and include chat identifier [chat ID]. Confirm the final recipient list before sending.
Run a Verified Delivery Workflow
Generate [report], preview the exact payload, verify the approved Recoup endpoint and recipients, send it, then report the message identifier or failure.
最佳实践
- Use dry-run mode to inspect the endpoint, recipients, subject, and body before every important send.
- Use unique files with restrictive permissions and remove them after delivery.
- Confirm recipients and the trusted Recoup endpoint before sending sensitive content.
避免
- Do not build email payloads with shell interpolation or inline JSON quoting.
- Do not pass secrets, unrelated local files, or unapproved recipient addresses.
- Do not report success when the helper returns a nonzero exit code.
常见问题
Which message formats are supported?
The helper supports HTML and plain-text bodies supplied directly or read from local files.
Can I preview an email without sending it?
Yes. Dry-run mode validates the body and prints the target and serialized payload without making a network request.
Which credentials are required?
Live sending requires RECOUP_API_KEY or RECOUP_ACCESS_TOKEN in the environment. Dry-run mode does not require either credential.
What happens when no recipient is supplied?
The Recoup API defaults delivery to the account email associated with the credential.
Does the helper prevent empty emails?
Yes. It exits with an error unless the HTML or plain-text body contains non-whitespace content.
Does it support attachments or scheduled delivery?
No. The helper only sends HTML or plain-text messages with recipients, carbon copies, subjects, and optional chat identifiers.
开发者详情
作者
recoupable许可证
MIT
Skillstore 修订
r1
版本提示
作者未声明版本。
引用
c0756f573f674ae8ef8b62fdfe93dea11b4d2578
维护新鲜度
2026/8/11
使用量
0 次下载 · 0 次浏览
文件结构