recoup-catalog-review-deal

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted royalty statements (CSV, XLSX, PDF) as its primary input.
  • Ingestion points: Seller files in the source/ directory are read by normalization and extraction scripts.
  • Boundary markers: The skill treats source files as immutable evidence and follows strict normalization rules defined in its reference documentation.
  • Capability inventory: The skill writes to local workspace directories and executes validation scripts via subprocess.
  • Sanitization: Normalization scripts perform arithmetic cleaning and structured parsing, which inherently limits the risk of data confusion.
  • [DYNAMIC_EXECUTION]: Local scripts dynamically load sibling modules for code reuse.
  • Evidence: scripts/auto-column-map.py uses importlib.util to load normalize-royalty-statement.py at runtime. This is a standard Python pattern for loading scripts with non-identifier names.
  • [COMMAND_EXECUTION]: A readiness wrapper script executes other local validation scripts to verify deal data.
  • Evidence: scripts/run-deal-checks.py uses subprocess.run to call hardcoded internal scripts such as validate-deal-workspace.py using the current Python interpreter to ensure artifact consistency.
  • [EXTERNAL_DOWNLOADS]: The skill fetches catalog performance data from a vendor-owned API.
  • Evidence: The skill interacts with the Recoup Research API at https://api.recoupable.dev/api to retrieve streaming play counts and artist metadata. These resources are provided by the skill's author for catalog valuation purposes.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 02:15 PM