recoup-song
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and fetches guidelines, templates, and API documentation from the 'recoupable' organization on GitHub (e.g.,
github.com/recoupable/skills). This is documented neutrally as a trusted vendor per instructions. - [COMMAND_EXECUTION]: The skill documents the use of
POSTandGETrequests toapi.recoupable.dev. These are scoped to the intended functionality of music generation and require explicit user approval at the 'Call Gate'. - [CREDENTIALS_UNSAFE]: The skill explicitly instructs the agent to never print credentials or include them in artifacts, recommending the use of environment variables like
RECOUP_API_KEY. It does not contain hardcoded secrets. - [SAFE]: No malicious patterns such as prompt injection, persistence, or obfuscation were detected. The skill follows best practices for API interaction and user consent.
Audit Metadata