ClawHub
Back to skill

Security audit

Coding Agent

Security checks across malware telemetry and agentic risk

Overview

This skill clearly describes a coding-agent integration that can read, edit, and run commands in a user-selected project, with write and execute actions requiring approval by default.

Install this only if you want CellCog to act as a coding agent on your machine. Keep write and execute approvals enabled unless you are working in a low-risk project directory, review proposed changes before approving them, and avoid pointing the working directory at broad home, credentials, or sensitive business-data folders.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- `HumanComputer_Terminal_File_Edit` — Edit files on the user's machine

### Safety Model
- **Read operations** are auto-approved (no interruption)
- **Write/execute operations** require user approval in the CellCog web UI
- Users can configure auto-approve for reads/writes within the working directory
- Sensitive paths (credentials, SSH keys) are always blocked
Confidence
84% confidence
Finding
The skill explicitly promotes a model where users can configure auto-approval for reads and writes within the working directory while granting a coding agent terminal, file read, file write, and file edit capabilities on the user's machine. In the context of an autonomous coding agent, reduced approval barriers can allow unintended file modification, execution of harmful commands, or bulk repository changes with limited human oversight.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
### Safety Model
- **Read operations** are auto-approved (no interruption)
- **Write/execute operations** require user approval in the CellCog web UI
- Users can configure auto-approve for reads/writes within the working directory
- Sensitive paths (credentials, SSH keys) are always blocked

---
Confidence
85% confidence
Finding
This section states that users can configure auto-approve for reads/writes inside the working directory, which weakens the human-in-the-loop control otherwise presented as the main safety boundary. Because the skill is designed for direct machine access and terminal operations, auto-approval materially increases the risk of prompt-influenced destructive edits, secret exposure from in-repo files, or dangerous command execution in trusted project paths.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- **macOS and Linux only** — CellCog Desktop (Co-work) is not yet available on Windows
- **CellCog Desktop required** — Without Co-work, CodeCog can still write code in its Docker workspace, but cannot access the user's machine directly
- **User approval for writes** — Write operations pause for user approval (configurable auto-approve available)
Confidence
83% confidence
Finding
The limitation note normalizes configurable auto-approval for write operations despite the skill's core function being autonomous coding on the user's real machine. In this context, auto-approved writes can let the agent persist incorrect or malicious changes rapidly, and when paired with terminal access, may facilitate broader compromise of project integrity.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.