Audio Generation

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:22 AM UTC
• Version: 1.0.17

Overview

This audio-generation skill is mostly coherent, but it combines voice-cloning guidance with mutable dependency installation and limited safety scoping.

Review this before installing if you need strong supply-chain control or plan to use cloned voices. Install CellCog in an isolated environment, prefer pinned versions or verified sources where possible, expose only CELLCOG_API_KEY and required files, and use cloned/avatar voices only with explicit permission from the voice owner and without impersonation or deception.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:211

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 9 and lines 211–214
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

yaml

dependencies: [cellcog]

text

**Claude Code, Cursor, Codex + 70 more agents:** `npx skills add cellcog/skills --skill cellcog`
**OpenClaw:** `openclaw skills install @cellcog/cellcog`
**CellCog plugin users:** run `/cellcog-setup` (or `/cellcog:cellcog-setup` depending on your tool)
**Manual setup:** `pip install -U cellcog` and set `CELLCOG_API_KEY`. See the **cellcog** skill for SDK reference.

Technical Analysis

The Skill declares and recommends installing the external cellcog dependency without an exact version, immutable source revision, integrity hash, lockfile, or signature-verification procedure. The manual Python command uses -U, explicitly requesting the latest available package version.

Consequently, the code installed by these commands can change after the Skill has been reviewed. Package installation can execute package-controlled installation or runtime code that is not included in this project and was therefore outside the audit scope. This creates a supply-chain trust boundary in which compromise of the relevant registry account, package release, namespace, distribution infrastructure, or upstream repository could deliver unauthorized code.

There is no evidence in the reviewed project that the current dependency is malicious. The vulnerability arises from installing mutable, unaudited dependency content without integrity controls.

Attack Path

1. An attacker compromises an upstream package, registry account, namespace, repository, or distribution channel used by one of the documented installation commands.
2. The attacker publishes a malicious release under the expected dependency or Skill identity.
3. A user or agent follows the instructions in SKILL.md, such as running `pip ...[truncated 1223 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency to an exact, reviewed version rather than resolving the latest release.
2. For repository-based installation, pin an immutable commit hash instead of a branch or mutable tag.
3. Publish and verify cryptographic hashes for package artifacts. For Python installations, use a locked requirements file with hashes and enforce hash checking.
4. Provide lockfiles or equivalent reproducible dependency manifests for each supported installation method.
5. Remove -U from the default installation command so reviewed installations are not silently replaced by newer releases.
6. Document the authoritative package registry, publisher identity, and expected package provenance to reduce dependency-confusion and typosquatting risks.
7. Verify package signatures or registry provenance attestations where supported.
8. Audit each pinned dependency release, including installation hooks and transitive dependencies, before updating the documented version.
9. Run installation and execution with least privilege in an isolated environment, exposing only required files, network destinations, and environment variables.
10. Avoid placing unrelated credentials in the process environment when running the dependency, and rotate CELLCOG_API_KEY if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill promotes cloned/avatar voice generation as a feature but does not include an explicit warning about consent, impersonation, fraud, or abuse risks. In this context, the omission is materially dangerous because the skill directly enables production of speech that sounds like a real person, which can facilitate social engineering, identity misuse, and non-consensual deepfake content.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The skill instructs users to run npx skills add cellcog/skills --skill cellcog without pinning a specific package or version, which can cause installation of whatever is current at execution time. This creates a supply-chain risk: a compromised upstream package, typo-squatted dependency, or malicious update could be executed on the user's machine during install.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.