Security audit

3D Model Generation

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed CellCog integration for generating 3D models, with expected use of an API key and user-provided prompts or files.

Before installing, understand that prompts and any referenced images or files may be processed by CellCog's external service. Use an environment variable or secret manager for CELLCOG_API_KEY, avoid submitting confidential or regulated assets unless approved, and verify the CellCog package or skill source during installation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly encourages users to provide product photos, rough sketches, and spreadsheets of items to CellCog, but it does not disclose that these inputs are sent to an external third-party service. This can lead users to unintentionally transmit sensitive business assets, proprietary designs, or personal data without informed consent, especially in enterprise or product-design contexts.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The skill requires a CELLCOG_API_KEY but gives no guidance on secure credential handling. While it does not directly expose the key, omission of basic secret-management guidance increases the risk that users will hardcode the credential, paste it into prompts, commit it to source control, or otherwise mishandle it.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.