recoup-catalog-review-deal
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted royalty statements (CSV, XLSX, PDF) as its primary input.
- Ingestion points: Seller files in the
source/directory are read by normalization and extraction scripts. - Boundary markers: The skill treats source files as immutable evidence and follows strict normalization rules defined in its reference documentation.
- Capability inventory: The skill writes to local workspace directories and executes validation scripts via subprocess.
- Sanitization: Normalization scripts perform arithmetic cleaning and structured parsing, which inherently limits the risk of data confusion.
- [DYNAMIC_EXECUTION]: Local scripts dynamically load sibling modules for code reuse.
- Evidence:
scripts/auto-column-map.pyusesimportlib.utilto loadnormalize-royalty-statement.pyat runtime. This is a standard Python pattern for loading scripts with non-identifier names. - [COMMAND_EXECUTION]: A readiness wrapper script executes other local validation scripts to verify deal data.
- Evidence:
scripts/run-deal-checks.pyusessubprocess.runto call hardcoded internal scripts such asvalidate-deal-workspace.pyusing the current Python interpreter to ensure artifact consistency. - [EXTERNAL_DOWNLOADS]: The skill fetches catalog performance data from a vendor-owned API.
- Evidence: The skill interacts with the Recoup Research API at
https://api.recoupable.dev/apito retrieve streaming play counts and artist metadata. These resources are provided by the skill's author for catalog valuation purposes.
Audit Metadata