Instagram Reels

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:47 AM UTC
• Version: 1.0.18

Overview

The skill is coherently aimed at CellCog social-video generation, but users should review it because it sends creative prompts to an external service and recommends mutable, unpinned installation commands.

Review CellCog's data-handling and content-rights terms before using this skill, especially for private campaigns, client materials, unpublished brand assets, or third-party media. Prefer pinned, reviewed package versions and install in a constrained environment with only the CELLCOG_API_KEY and files needed for the task.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:231

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 231
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

text

**Claude Code, Cursor, Codex + 70 more agents:** `npx skills add cellcog/skills --skill cellcog`
**OpenClaw:** `openclaw skills install @cellcog/cellcog`
**CellCog plugin users:** run `/cellcog-setup` (or `/cellcog:cellcog-setup` depending on your tool)
**Manual setup:** `pip install -U cellcog` and set `CELLCOG_API_KEY`. See the **cellcog** skill for SDK reference.

Technical Analysis

The installation instructions retrieve third-party components without pinning an exact reviewed version or validating an integrity hash. In particular, pip install -U cellcog intentionally selects the latest available package release, while the npx and OpenClaw installation commands similarly reference mutable upstream package or repository state.

The project does not include a lockfile, package hashes, vendored dependency source, or another mechanism that binds installation to the implementation reviewed during this audit. Consequently, the effective code installed by these commands can change after the skill has been reviewed. Package installation hooks and subsequently imported SDK code may execute with the privileges of the user running the agent.

Attack Path

1. An attacker compromises an upstream package publisher, registry account, repository, release process, or transitive dependency.
2. The attacker publishes a malicious version under a dependency name referenced by the documented installation commands.
3. A user follows the instructions in SKILL.md without an exact version or integrity constraint.
4. The package manager resolves and downloads the attacker-controlled release.
5. Malicious installation hooks or runtime package code execute in the user's environment when the package is installed or imported.

This attack path d ...[truncated 644 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency to an exact version that has undergone security review.
2. Use lockfiles and cryptographic integrity hashes where supported, such as hash-checked Python requirements.
3. Document and verify the canonical registry, publisher, and repository for each package.
4. Avoid automatic upgrades such as pip install -U in security-sensitive installation guidance.
5. Review dependency source code and release provenance before approving version updates.
6. Disable package installation scripts where feasible and perform installation in a restricted environment.
7. Run the SDK with least privilege and expose only the credentials and files required for the task.
8. Use automated dependency monitoring and require explicit review before updating pinned versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill routes user prompts and potentially media-generation instructions to an external service but does not clearly warn users about privacy, confidentiality, copyright, or data-handling implications. In this context, users may submit sensitive business content, unpublished campaign materials, brand assets, or third-party creative inputs without understanding that those materials may leave the local environment and be subject to external processing and policy constraints.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs users to run npx skills add cellcog/skills --skill cellcog without pinning a specific package or repository version, which can cause users to install whatever the latest upstream content resolves to at execution time. That creates a supply-chain risk: a compromised package, changed tag, or malicious update could silently alter installed code or skill behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.