Recoup Sandbox Setup

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:08 PM UTC
• Version: 1.0.0

Overview

The skill mostly matches its setup purpose, but it tells an agent to broadly stage and push repository changes and to install another unpinned remote skill.

Review carefully before installing. Only run the setup in the intended repository, inspect generated files and `git status` before committing, stage only the intended `orgs/.../RECOUP.md` paths, avoid pushing directly to `main` unless you explicitly approve the remote and branch, and install any follow-on skill only from a pinned or reviewed source.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:55
• Finding: Unpinned Remote Skill Installation Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 55-59 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```markdown After the sandbox is set up, run the `setup-artist` skill for each artist. If the skill is not installed, install it first: ```bash npx skills add recoupable/setup-artist ``` ``` ### Technical Analysis The instructions recommend downloading and installing a remotely maintained Skill through `npx` without pinning a package or Skill version, verifying an integrity digest, validating the publisher, or requiring a security review of the retrieved content. Because the referenced dependency is mutable, its effective instructions or executable components may change after this Skill has been audited. The command therefore creates a supply-chain trust boundary through which a compromised package, publisher account, registry, or referenced Skill could introduce malicious content. Installation is not required to perform the current Skill's core local scaffolding operation. It is presented only as a subsequent action, so automatically installing it would exceed the minimum privileges and dependencies necessary for the declared setup task. ### Attack Path 1. An attacker compromises the package publisher, registry entry, source repository, or account responsible for `recoupable/setup-artist`. 2. The attacker publishes a modified Skill or causes the unpinned reference to resolve to malicious content. 3. A user or agent follows `SKILL.md` and executes `npx skills add recoupable/setup-artist`. 4. The remote content is downloaded and installed without integrity verification or review. 5. When the installed Skill or associated package lifecycle is executed, its malicious instructions or code operate with the permissions available to the user or agent. ### Impact Assessment The immediate impact is the installation of unreviewed, remotely mutable content. ...[truncated 317 chars]
• Remediation: ## Remediation Suggestions - Pin both the package runner and installed Skill to explicitly reviewed versions. - Use an official, authenticated registry and verify package provenance and publisher identity. - Require an integrity hash, signed release, lockfile, or equivalent immutable reference. - Download and inspect the dependency before activating or executing it. - Do not automatically install the subsequent Skill as part of sandbox setup; require explicit user approval. - Run installation and review in an isolated environment with restricted filesystem, credential, and network access. - Document the expected files, permissions, and network destinations used by the dependency.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:19
• Finding: Broad Staging and Unconfirmed Publication of Account Metadata## Vulnerability Details **File Location**: `SKILL.md`, lines 19-37 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code ```markdown 4. Create the folder structure and a `RECOUP.md` marker in each artist folder: - `mkdir -p orgs/{org}/artists/{artist-slug}` for each org/artist pair - Write a `RECOUP.md` in each artist folder using the template below 5. Commit and push: - `git add -A && git commit -m "setup: create org and artist folders" && git push origin main` ## `RECOUP.md` Every artist directory has a `RECOUP.md` at its root. This is the **identity file** — it connects the workspace to the Recoupable platform and tracks setup status. It stays permanently. Fill it with data from the CLI response: ```markdown --- artistName: {Artist Name} artistSlug: {artist-slug} artistId: {uuid-from-recoupable} status: not-setup --- ``` ### Technical Analysis The Skill directs the agent to execute `git add -A`, commit the resulting index, and push it directly to `origin/main`. This has two security consequences: 1. `git add -A` stages every tracked modification, deletion, and untracked file not excluded by Git configuration. Its scope is broader than the generated `orgs/.../RECOUP.md` files and may capture unrelated workspace content. 2. The generated files contain account-related artist names, slugs, and Recoup UUIDs. The instructions publish this metadata to the configured Git remote without first validating the remote URL, checking repository visibility, reviewing the staged diff, or obtaining explicit approval. Fetching organization and artist information through the Recoup CLI is consistent with the declared functionality. Publishing that information, along with every other staged workspace change, is not required merely to scaffold the local filesystem and therefore exceeds minimum necessary access. ### Attack Path 1. The wor ...[truncated 1359 chars]
• Remediation: ## Remediation Suggestions - Replace `git add -A` with explicit path-scoped staging, such as staging only the generated `orgs/.../RECOUP.md` files. - Validate and display the resolved `origin` URL before any network operation. - Show `git status` and the complete staged diff, then require explicit user confirmation before committing or pushing. - Check whether the destination repository is private and approved for account metadata. - Create a local commit or review branch by default instead of pushing directly to `main`. - Allow users to opt out of storing platform UUIDs, or replace them with less sensitive references when full identifiers are unnecessary. - Add restrictive ignore rules and perform secret scanning before staging. - Separate local filesystem scaffolding from optional remote publication so the core task can run without Git network access.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill directs the agent to create directories/files and then `git add`, `git commit`, and `git push origin main` without an explicit warning, confirmation gate, or requirement for user approval before publishing changes. This is dangerous because it can exfiltrate account-derived metadata into a remote repository, overwrite expected workflow boundaries, and cause irreversible repository modifications from what appears to be a setup task.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence
• Finding: The skill instructs users to run `npx skills add recoupable/setup-artist` without pinning an exact package/version, which creates a supply-chain risk: the fetched code may change over time or be replaced by a compromised release. In a skill that is explicitly intended to modify the workspace and later influence additional setup steps, executing an unpinned package can lead to arbitrary code execution or installation of malicious instructions.

Static analysis

No suspicious patterns detected.