getting-started

Warn

Audited by Gen Agent Trust Hub on Apr 14, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the @recoupable/cli package from the public NPM registry to provide the agent with the necessary tooling for the platform.
  • [COMMAND_EXECUTION]: The skill uses curl to interact with the vendor's API endpoint at recoup-api.vercel.app to automate account registration and retrieve an API key.
  • [COMMAND_EXECUTION]: The skill modifies the user's shell configuration file (~/.zshrc) to store the RECOUP_API_KEY environment variable, which allows the credentials to persist across different terminal sessions.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 14, 2026, 03:04 AM
Security Audit — agent-trust-hub — getting-started