Story Cog

• Outcome: Pass
• Latest audit: May 28, 2026, 8:05 AM
• Version:
  1.0.10

Overview

Story Cog is a disclosed creative-writing helper for CellCog with no executable payload, but users should protect their CellCog API key and be mindful that prompts may be processed by CellCog.

Install only if you trust CellCog for creative-writing processing. Keep CELLCOG_API_KEY in environment variables or a secret manager, do not paste it into prompts or logs, and avoid sending confidential manuscripts, personal data, regulated data, or secrets unless you are comfortable with CellCog handling that content.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The skill advertises very broad creative-writing capabilities without clear activation boundaries, which can cause over-invocation or make it easier for the skill to be selected in contexts beyond its intended use. In an agent ecosystem, overly generic descriptions increase confusion and may expand the opportunity for misuse, though this file does not contain direct code-execution or exfiltration behavior.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The documentation notes that CELLCOG_API_KEY is required but does not explicitly warn that it is a sensitive secret that must not be exposed, logged, or embedded in prompts. In agent settings, lack of secret-handling guidance can lead to accidental credential disclosure during setup, debugging, or prompt construction.

VirusTotal

60/60 vendors flagged this skill as clean.