Brainstorming

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:47 AM UTC
• Version: 1.0.17

Overview

This skill is a straightforward CellCog brainstorming helper, with a normal but worth-noting supply-chain caution around unpinned install commands.

Before installing, confirm the CellCog package/source is the one you intend to trust, consider pinning versions or using an isolated environment, and use a narrowly scoped CELLCOG_API_KEY because prompts and follow-up messages are sent to the CellCog service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:259

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 259–263
Vulnerability Type: Unpinned external dependencies and unsafe automatic upgrades
Risk Level: Medium

Vulnerable Code

markdown

**Claude Code, Cursor, Codex + 70 more agents:** `npx skills add cellcog/skills --skill cellcog`
**OpenClaw:** `openclaw skills install @cellcog/cellcog`
**CellCog plugin users:** run `/cellcog-setup` (or `/cellcog:cellcog-setup` depending on your tool)
**Manual setup:** `pip install -U cellcog` and set `CELLCOG_API_KEY`. See the **cellcog** skill for SDK reference.
**Other agents:** `pip install cellcog` and set `CELLCOG_API_KEY`. See https://cellcog.ai for details.

Technical Analysis

The installation instructions retrieve third-party components without specifying an exact version, integrity hash, lockfile, or immutable source revision. The pip install -U cellcog command explicitly upgrades to whichever version the package index currently identifies as the latest compatible release.

Consequently, the code installed by users may differ from the dependency version that existed when this skill was audited. If the upstream publisher account, package repository, distribution infrastructure, or dependency chain is compromised, a malicious release could be delivered through these otherwise legitimate-looking commands. Python package installation can invoke build-system behavior, while the installed client subsequently operates inside the user's agent environment.

The artifact contains no implementation of the CellCog client, so its installation-time behavior, network handling, credential handling, and file access cannot be independently verified from this project.

Attack Path

1. An attacker compromises an upstream CellCog publishing account, repository, package distribution channel, or transitive dependency.
2. The attacker publishes a malicious release under the dependency name referenced by the unpinned ...[truncated 1498 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every external dependency to an exact, reviewed version rather than resolving the latest available release.
2. For Python installations, publish a requirements or lock file containing cryptographic hashes and require hash verification, such as pip install --require-hashes.
3. Replace pip install -U cellcog with installation of a specifically audited version; upgrades should be deliberate and reviewed.
4. Pin skill installations to an immutable release tag or commit digest where the relevant tooling supports it.
5. Document the expected official package registry, publisher identity, repository, and release-signing or provenance information.
6. Verify package signatures, attestations, and checksums before installation.
7. Review new dependency releases and transitive dependency changes before updating the pinned version.
8. Perform installation and execution as a non-privileged user in a sandbox or isolated virtual environment with minimal filesystem and network access.
9. Expose CELLCOG_API_KEY only to the process that requires it, use a narrowly scoped credential, and support prompt credential rotation if compromise is suspected.
10. Provide or reference auditable client source so users can inspect installation hooks, outbound network behavior, credential handling, and file-access behavior.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The skill instructs users to run npx skills add cellcog/skills --skill cellcog without pinning an exact package/version, which can cause execution of whatever package version is current at install time. If the upstream package, dependency chain, or package resolution is compromised, users could execute unreviewed code during installation; because this is an installation command in a skill file, the context makes the risk more actionable rather than theoretical.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.