Avatar Creation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:02 AM UTC
• Version: 1.0.6

Overview

The skill is coherent for creating CellCog avatars, but it handles persistent images and cloned voices with insufficient privacy, consent, and install-integrity guidance.

Review this before installing if you plan to upload real faces or voices. Only clone voices you have permission to use, avoid uploading sensitive third-party identity data, and confirm CellCog's retention and deletion controls. Prefer pinned or verified package versions instead of the mutable npx and pip install -U commands shown in the skill.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:219

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 219-222
Vulnerability Type: Unpinned and unverifiable third-party dependencies
Risk Level: Medium

Vulnerable Code

markdown

**Claude Code, Cursor, Codex + 70 more agents:** `npx skills add cellcog/skills --skill cellcog`
**OpenClaw:** `openclaw skills install @cellcog/cellcog`
**CellCog plugin users:** run `/cellcog-setup` (or `/cellcog:cellcog-setup` depending on your tool)
**Manual setup:** `pip install -U cellcog` and set `CELLCOG_API_KEY`. See the **cellcog** skill for SDK reference.

Technical Analysis

The setup instructions install third-party packages without pinning an exact reviewed version, verifying a cryptographic checksum, or requiring a signed release. In particular, pip install -U cellcog explicitly selects an available upgrade, while the npx and OpenClaw installation commands similarly do not identify an immutable package version or commit.

Package installers can execute code supplied by packages or their dependencies during installation and subsequent use. Consequently, the effective code installed by these commands may differ from the code that existed when this skill was audited. This creates a supply-chain trust boundary in which compromise of a package publisher, registry entry, source repository, release process, or transitive dependency could result in attacker-controlled code being installed.

The documentation openly instructs the user to perform these installations; no evidence shows that SKILL.md performs an automatic or covert installation. The vulnerability is therefore the unsafe dependency acquisition pattern rather than an embedded malicious payload.

Attack Path

1. An attacker compromises the CellCog package publisher, upstream repository, registry account, build pipeline, or a dependency selected during resolution.
2. The attacker publishes a malicious release under the package or source identifier ...[truncated 1130 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every installation command to a specific, reviewed release instead of resolving the latest available version.
2. For Python installation, use an exact version and require hashes through a reviewed requirements or lock file, for example:

   text

   cellcog==<reviewed-version> --hash=sha256:<verified-hash>
   

3. Pin npm, OpenClaw, and source-based installations to immutable versions or commit hashes where supported.
4. Publish checksums or signatures through an authenticated channel and document how users should verify them before installation.
5. Commit lockfiles that pin transitive dependencies and review dependency changes before updating them.
6. Remove the automatic upgrade behavior represented by pip install -U from standard setup guidance.
7. Recommend installation in an isolated virtual environment or sandbox with minimal filesystem, credential, and network access.
8. Document the authoritative registries and publisher identities so users can detect dependency confusion or similarly named packages.
9. Add routine dependency provenance, vulnerability, and release-integrity checks to the maintenance process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill emphasizes that avatars are stored at the account level and automatically available across chats, but it does not clearly warn users that uploaded images, voice clones, and persona data persist and may be visible or reused in future contexts. In this skill's context, that increases privacy and data-governance risk because highly sensitive identity data is being normalized for broad reuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill promotes voice cloning from uploaded audio samples but provides no warning about obtaining the speaker's consent, legal rights, or privacy implications. This creates a realistic risk of unauthorized biometric voice collection and impersonation, especially because the feature is presented as frictionless and immediately usable.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The skill instructs users to install tooling via npx skills add ... without pinning an exact version, which can lead to supply-chain risk if a newer or compromised package version is resolved at install time. In a skill-installation context, this is more dangerous because users are explicitly encouraged to execute the command directly on their systems.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.