recoup-content-write-caption
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documentation provides shell snippets using
curlandjqto interact with the Recoup platform API (api.recoupable.com). These are standard administrative and data-retrieval operations within the vendor's ecosystem. - [DATA_EXFILTRATION]: The skill handles sensitive authentication tokens (
RECOUP_API_KEY,RECOUP_ACCESS_TOKEN) via environment variables and transmits them to the official vendor domain. This is consistent with standard API usage and follows the vendor's documented security practices. - [PROMPT_INJECTION]: A quality assurance instruction ("Analyze gate") advises the agent to verify visual output using an automated critique API before confirming completion to the user. While this involves conditional reporting, it is explicitly framed as a quality control measure to prevent the delivery of technical artifacts or off-brand content, rather than a malicious concealment attempt.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources, including social media posts and web research signals, to inform caption generation. While this represents a data ingestion surface, the skill implements a "fingerprinting" procedure to verify generated text against known artist characteristics, providing a layer of validation for the resulting output.
Audit Metadata