Resume Cog

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Anyone using the skill must provide a CellCog API key, which may allow access to the user's CellCog account or consume account usage.

Why it was flagged

The skill requires a CellCog API key, which is expected for using the CellCog service but is still a credential that should be protected.

Skill content
requires:\n      bins: [python3]\n      env: [CELLCOG_API_KEY]
Recommendation

Use a dedicated CellCog API key if possible, keep it out of prompts and shared files, and revoke or rotate it if it is exposed.

What this means

Resume and cover letter prompts may contain sensitive personal, employment, and education information that will be processed by CellCog.

Why it was flagged

The user's task prompt is sent to CellCog for agent-based processing; the resume examples include personal career details such as name, employment history, education, and skills.

Skill content
result = client.create_chat(\n    prompt="[your task prompt]",\n    ...\n    chat_mode="agent",\n)
Recommendation

Only provide information you are comfortable sending to CellCog, review CellCog's privacy and retention terms, and avoid including unnecessary sensitive identifiers.

What this means

The behavior depends on the external CellCog SDK/package and service, so trust in that dependency matters.

Why it was flagged

The skill relies on an external CellCog Python dependency rather than including reviewed local code in the artifact set.

Skill content
dependencies: [cellcog]
Recommendation

Install the CellCog dependency only from the official source and keep it updated through trusted package management.