Security audit
Story Cog
Security checks across malware telemetry and agentic risk
Overview
Story Cog is a disclosed creative-writing helper for CellCog, with no executable payload beyond examples, but users should protect their API key and avoid sending private manuscripts unless they trust the service.
Install this if you trust CellCog to process your creative-writing prompts and drafts. Keep CELLCOG_API_KEY in environment variables or a secret manager, do not paste it into prompts or logs, and avoid sending confidential manuscripts, personal data, regulated data, or secrets unless you are comfortable with CellCog handling that content.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
60/60 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.