Coding Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:16 AM UTC
• Version: 1.0.15

Overview

The skill is clear about giving CellCog local coding-agent access, but its mutable install path and configurable write auto-approval make it something users should review carefully before installing.

Install only if you trust CellCog and the separately installed Desktop/runtime components. Keep Co-work scoped to a single project directory, leave write auto-approve disabled, review write and command actions before approval, and avoid using it on repositories containing secrets or highly sensitive data unless you have verified the installed CellCog versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:57

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57–64
Vulnerability Type: Unpinned remote dependency installation
Risk Level: Medium

Vulnerable Code

markdown

```bash
# Claude Code, Cursor, Codex + 70 more agents
npx skills add cellcog/skills --skill cellcog

# OpenClaw
openclaw skills install @cellcog/cellcog

text

### Technical Analysis

The skill directs users to install third-party CellCog components without specifying an immutable version, commit hash, checksum, or cryptographic signature. Consequently, the content installed by these commands may differ from the content available when this skill was audited.

The `npx`-based installation also depends on remotely resolved package-registry content and its transitive dependency chain. A compromised publisher account, upstream repository, registry package, or later malicious release could therefore alter the effective installed payload.

This risk is particularly relevant because the installed integration is intended to support Co-work functionality with local filesystem access and terminal execution. No evidence establishes that the current upstream component is malicious; the vulnerability is the mutable and insufficiently verified supply-chain trust model.

### Attack Path

1. An attacker compromises the upstream package, repository, publisher account, or a relevant transitive dependency.
2. The attacker publishes a modified release under the same unpinned installation reference.
3. A user follows the prerequisite installation command in `SKILL.md`.
4. The package manager resolves and installs the attacker-controlled version because no immutable version or integrity value is required.
5. When the integration is invoked with Co-work enabled, the malicious component can request operations through its available local filesystem and terminal capabilities.
6. If the user approves those operations or has configured automatic approval, the malicious payload can act within the grant
...[truncated 845 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every installation reference to a reviewed, immutable release version or commit hash.
2. Provide expected cryptographic checksums or signatures and require verification before installation.
3. Publish the exact trusted repository, registry namespace, maintainer identity, and supported dependency versions.
4. Use lockfiles or equivalent dependency constraints to pin transitive dependencies.
5. Avoid installation commands that implicitly execute mutable registry content where a verified installation mechanism is available.
6. Document a process for reviewing dependency updates before changing pinned references.
7. Keep Co-work access limited to the smallest necessary directory.
8. Retain interactive approval for writes and command execution; do not recommend automatic approval by default.
9. Run the integration with a low-privilege operating-system account or within a sandbox where feasible.
10. Record and display the resolved package version and integrity information so users can confirm what was installed.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The metadata claims Windows support, while the body states Co-work is unavailable on Windows. This inconsistency can cause the skill to be offered or attempted on unsupported platforms, leading users or orchestrators to misconfigure trust boundaries and assume direct-machine-access safeguards or behaviors that do not actually exist.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

This skill is explicitly designed to grant an AI coding agent terminal, file read, write, and edit access on the user's machine, and the documented auto-approve capability lowers the human review barrier for those actions. In a coding-agent context, that is dangerous because prompt injection, task confusion, or malicious repository instructions could translate directly into unauthorized code execution or destructive filesystem changes within the working directory.

Content

Scanner excerpt · SKILL.md (reported line 248)May include surrounding context.

md

- `HumanComputer_Terminal_File_Edit` — Edit files on the user's machine

### Safety Model
- **Read operations** are auto-approved (no interruption)
- **Write/execute operations** require user approval in the CellCog web UI
- Users can configure auto-approve for reads/writes within the working directory
- Sensitive paths (credentials, SSH keys) are always blocked

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The text states users can configure auto-approve for reads/writes within the working directory, which materially increases risk in a tool that performs autonomous coding operations. In this context, a compromised task prompt or malicious repository content could cause silent mass edits, dependency changes, or execution of harmful build/test scripts with reduced user oversight.

Content

Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.

md

### Safety Model
- **Read operations** are auto-approved (no interruption)
- **Write/execute operations** require user approval in the CellCog web UI
- Users can configure auto-approve for reads/writes within the working directory
- Sensitive paths (credentials, SSH keys) are always blocked

---

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The limitation section reiterates that write operations may use configurable auto-approve, confirming that this is not incidental wording but part of the intended operating model. Because the skill's core purpose is direct machine access for an autonomous coding agent, auto-approved mutations substantially raise the chance of unauthorized edits, persistence mechanisms, or execution of unsafe commands without meaningful human intervention.

Content

Scanner excerpt · SKILL.md (reported line 269)May include surrounding context.

md

- **macOS and Linux only** — CellCog Desktop (Co-work) is not yet available on Windows
- **CellCog Desktop required** — Without Co-work, CodeCog can still write code in its Docker workspace, but cannot access the user's machine directly
- **User approval for writes** — Write operations pause for user approval (configurable auto-approve available)

Static analysis

No suspicious patterns detected.