Security audit

Deep Research

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent CellCog deep-research skill with external-service and install-supply-chain risks that users should understand, but no evidence of hidden, destructive, or deceptive behavior.

Install only if you trust CellCog as a third-party research provider. Treat prompts, uploaded context, and generated research requests as data shared with CellCog, avoid sending secrets or regulated data unless approved, and prefer pinned package versions or reviewed release sources where possible.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:192
Finding: Unpinned Third-Party Dependencies and Mutable Installation Sources
Content: View full analysis
Remediation: View remediation
`. 3. Pin skill installations to immutable release identifiers or commit hashes where supported. 4. Publish and verify cryptographic hashes or signatures for downloaded artifacts. 5. Provide a lockfile or constraints file containing the complete resolved dependency graph and integrity metadata. 6. Avoid automatic upgrade flags in security-sensitive installation documentation. 7. Document the expected package publisher, repository, and network endpoints so users can verify provenance. 8. Run installation and execution in a least-privileged sandbox with restricted filesystem and network access. 9. Keep `CELLCOG_API_KEY` narrowly scoped, rotate it periodically, and prevent unnecessary child processes from inheriting it. 10. Review each dependency update before changing the pinned version, including installation hooks and transitive dependencies. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill presents an external research service workflow but does not clearly warn that prompts, attached task content, and potentially sensitive research materials are sent to CellCog. Users may unknowingly transmit confidential business, financial, legal, or proprietary data to a third party, creating privacy, compliance, and data-governance risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The skill instructs users to run npx skills add ... without pinning a specific version, which can fetch whatever package version is current at execution time. That creates a supply-chain risk: a compromised or malicious upstream release could execute unexpected code on the user's machine during install.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.