recoup-content-connect-fans
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: In SKILL.md and references/api.md, the skill communicates with the vendor's API domain (api.recoupable.dev) to manage fan connection settings and site attribution. The instructions include explicit warnings against printing credentials, leaking fan personal details, or storing sensitive information in public repositories.
- [CREDENTIALS_UNSAFE]: In SKILL.md, the skill instructs the agent on how to manage API keys, prioritizing secure environment storage and strictly forbidding the inclusion of secrets in website code, URLs, or logs. No hardcoded secrets were found in the provided files.
- [INDIRECT_PROMPT_INJECTION]: As seen in references/api.md, the skill ingests external fan data (such as emails and Spotify IDs) for verification purposes. This data is used purely for status checks and is not passed to any tools capable of code execution or shell interaction, mitigating the risk of injection attacks.
Audit Metadata