ClawHub
Back to skill

Security audit

AI Employees

Security checks for vulnerabilities and agentic risk

Overview

The skill’s ongoing AI workers, memory, file sharing, and usage charges are disclosed and consistent with its purpose.

Messages and attached files are sent to CellCog for ongoing project work, so share only approved material and exclude secrets. Check account approval settings and credit spending before scheduling routines. Pause or delete employees through the website, and prefer reviewed dependency versions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: ai-employees-cellcog
description: "Work with CellCog AI employees from your own agent: long-running teammates that keep memory, learn skills you teach them, run routines, and stay consistent across a project for days or months. Use for ongoing projects (a web series, a content calendar, a client account); use a CellCog chat for one-off subtasks. Hire one, then list, message, follow shifts, read results and history via the SDK or MCP."
author: CellCog
homepage: https://cellcog.ai
metadata:
  openclaw:
    emoji: "🧑‍💼"
    os: [darwin, linux, windows]
    requires:
      bins: [python3]
      env: [CELLCOG_A

File-sharing instructions omit a warning that local file contents are sent to CellCog.

Medium
Category
Output Handling
Confidence
91% confidence
Finding

The skill instructs the agent to include local files in employee messages using absolute-path tags, but does not warn that their contents will be transmitted to the third-party CellCog service. This can expose confidential project or client data, especially given the persistent employee context described elsewhere in the skill.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

The installation command invokes an unpinned npm CLI through npx and retrieves skill content without an immutable revision, creating a supply-chain integrity weakness. A compromised future release or upstream repository could introduce code or instructions that run with the agent user's privileges. This is an installation risk, not an unversioned MCP server as the finding's label suggests; no actual compromise is evident.

Content

No source excerpt is available for this finding.