Image Generation

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:22 AM UTC
• Version: 1.0.17

Overview

This skill is a straightforward CellCog image-generation guide, with expected third-party API use and unpinned install commands that users should handle carefully.

Install from the official CellCog/OpenClaw source, prefer pinned versions in production, and avoid sending secrets, private documents, regulated data, or unauthorized reference images through prompts or uploads unless your organization permits CellCog processing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:188

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 188-191
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

text

**Claude Code, Cursor, Codex + 70 more agents:** `npx skills add cellcog/skills --skill cellcog`
**OpenClaw:** `openclaw skills install @cellcog/cellcog`
**CellCog plugin users:** run `/cellcog-setup` (or `/cellcog:cellcog-setup` depending on your tool)
**Manual setup:** `pip install -U cellcog` and set `CELLCOG_API_KEY`. See the **cellcog** skill for SDK reference.

Technical Analysis

The installation instructions retrieve third-party packages without pinning an audited version or verifying cryptographic integrity. The use of pip install -U cellcog explicitly selects an available newer release, while the npx and OpenClaw installation commands similarly identify packages without immutable versions.

Consequently, the code ultimately installed and executed can differ from the content available at audit time. If a package registry, publisher account, release pipeline, or transitive dependency is compromised, a malicious release could be delivered through these documented commands. Package installation hooks or later SDK imports could then execute attacker-controlled code in the user's environment.

No evidence shows that the currently referenced packages are malicious; the vulnerability is the unsafe, non-reproducible dependency acquisition process.

Attack Path

1. An attacker compromises a referenced package publisher account, package registry entry, release pipeline, or transitive dependency.
2. The attacker publishes a malicious release under the expected package name.
3. A user follows one of the documented unpinned installation instructions.
4. The package manager resolves the mutable package reference to the malicious release.
5. Attacker-controlled code executes during installation or when the installed package ...[truncated 772 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency and skill to a specific reviewed version rather than resolving the latest available release.
2. Replace pip install -U cellcog with an exact version constraint, such as pip install cellcog==<reviewed-version>.
3. Use lockfiles with hashes and require package hash verification where supported.
4. Pin npx and OpenClaw skill installations to immutable versions, release artifacts, or commit identifiers.
5. Document the expected official registry, publisher identity, and source repository so users can detect dependency confusion or spoofed packages.
6. Review transitive dependencies and use automated vulnerability and provenance checks in the release process.
7. Perform installation and execution in a least-privileged, isolated environment with only the files and environment variables required for image-generation tasks.
8. Avoid exposing CELLCOG_API_KEY to installation scripts; provide it only to the runtime process after dependency installation and verification.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill requires a CELLCOG_API_KEY and demonstrates sending prompts and generation requests through the CellCog client, but it never clearly tells users that their prompts and possibly attached files are sent to an external third-party service. This can mislead users about data boundaries and create privacy, legal, and trade-secret exposure if sensitive prompts or images are submitted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill encourages uploading reference images for style, character, and brand alignment but does not warn that those images may be transmitted to a third-party service for processing. Users may unknowingly submit sensitive personal, proprietary, or copyrighted images, increasing privacy, confidentiality, and compliance risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The skill instructs users to run npx skills add cellcog/skills --skill cellcog without pinning a specific package or version. This creates a supply-chain risk because users may fetch whatever package version is current at execution time, including a compromised or typo-squatted dependency path if the ecosystem is abused.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.