PDF Document Generation

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:46 AM UTC
• Version: 1.0.18

Overview

The skill appears purpose-aligned for CellCog document generation, but it handles potentially sensitive document content through an external service and recommends mutable install paths without enough disclosure.

Review CellCog's privacy, retention, and security terms before submitting legal, HR, financial, confidential, or regulated content. Prefer pinned or checksum-verified installation methods where available, install in a least-privileged environment, and protect the CELLCOG_API_KEY like any other credential.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:243

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13 and 243–246
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Complete Code Snippet

yaml

dependencies: [cellcog]

markdown

**Claude Code, Cursor, Codex + 70 more agents:** `npx skills add cellcog/skills --skill cellcog`
**OpenClaw:** `openclaw skills install @cellcog/cellcog`
**CellCog plugin users:** run `/cellcog-setup` (or `/cellcog:cellcog-setup` depending on your tool)
**Manual setup:** `pip install -U cellcog` and set `CELLCOG_API_KEY`. See the **cellcog** skill for SDK reference.

Technical Analysis

The skill declares and recommends installing third-party components without pinning a reviewed version, immutable commit, package hash, or signature. The pip install -U cellcog command explicitly retrieves the latest available release. The npx and OpenClaw installation paths similarly identify mutable package or repository locations.

This does not establish that the current CellCog packages are malicious. However, it creates a supply-chain trust boundary in which code executed by users may differ from the code originally reviewed. A compromised package-publisher account, registry, repository, dependency, or later malicious release could introduce executable code. Python imports, package installation hooks, Node package execution through npx, or skill installation behavior could then run that code with the invoking process's permissions.

Attack Path

1. An attacker compromises a referenced package, repository, publisher account, registry path, or transitive dependency.
2. The attacker publishes a malicious release under the expected package identity.
3. A user follows one of the documented unpinned installation procedures.
4. The package manager or skill installer resolves the mutable reference to the malicious release.
5. Installation hooks, setup logic, imported SDK code, or installed skill instructions execute atta ...[truncated 767 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency to a reviewed, exact version rather than installing the latest release.
2. Replace mutable repository references with immutable commit hashes or signed release tags.
3. Use lockfiles and integrity controls, such as package hashes, to ensure reproducible installation.
4. Remove -U from the pip command so installation does not silently replace a reviewed version with a newer release.
5. Verify package provenance, publisher identity, signatures, and registry source before installation.
6. Restrict package installation and execution to a sandbox or least-privileged environment without unnecessary credentials.
7. Audit direct and transitive dependencies before updating pinned versions.
8. Document a controlled update process that reviews release changes before modifying the approved version or integrity hash.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill markets document generation through an external service but does not clearly warn that prompts, uploaded content, and potentially sensitive legal, financial, or HR material may be sent off-platform. Given this skill explicitly targets resumes, contracts, NDAs, invoices, and legal documents, omission of a data-transfer warning materially increases confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The skill instructs users to install tooling via npx skills add ... without pinning a specific version, which can lead to execution of a newer or compromised package than intended. In a security-sensitive agent ecosystem, unpinned installer invocations increase supply-chain risk because behavior can change over time or be hijacked upstream.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill states that vague requests like "create a report" or "make a document" default to PDF. These are broad, everyday phrases without clear scope constraints or exclusion examples, which can lead to unintended behavior when the user did not explicitly ask for PDF.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.