recoup-content-write-caption
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted data from an artist's past social media posts to diarize a voice and generate new captions, creating an attack surface for indirect prompt injection. It also includes specific instructions to ensure transparency with the user.
- Ingestion points: Historical social media post data retrieved from the vendor's API and local artist context files located in the workspace.
- Boundary markers: The skill does not utilize explicit delimiters to isolate untrusted historical content, but relies on a diarization process to filter intent.
- Capability inventory: The agent can execute shell commands, perform network requests via curl, and read/write to the local filesystem.
- Sanitization: The skill incorporates an "anti-slop fingerprint" and verification checks to ensure output fidelity. Additionally, the "analyze gate" instructions prevent the agent from concealing failures or low-quality results from the user.
- [COMMAND_EXECUTION]: The skill provides functional shell command templates for data processing and API interaction.
- Reference files include bash scripts using
curl,jq,sed,tr, andlsfor workspace management and communication with the platform API. - Sourcing instructions suggest the use of
yt-dlpfor downloading audio assets from external platforms when local files are missing. - [DATA_EXFILTRATION]: The skill accesses sensitive authentication credentials and artist metadata stored in the environment and local workspace.
- It utilizes the
RECOUP_API_KEYandRECOUP_ACCESS_TOKENenvironment variables for authentication. - It reads identity metadata from workspace files like
RECOUP.mdto resolve artist identifiers. - Network activity involving these credentials is directed exclusively to the vendor's official domain (
api.recoupable.dev). - [EXTERNAL_DOWNLOADS]: The skill is configured to fetch necessary content and metadata from the vendor's API and other external sources.
- Downloads artist profiles, engagement metrics, and track analysis from the platform's research and content endpoints.
- Supports downloading audio files from sandbox repositories or via external utilities like
yt-dlpas a fallback mechanism.
Audit Metadata