Legal Documents

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:20 PM UTC
• Version: 1.0.16

Overview

This is a coherent CellCog legal-drafting skill, with a supply-chain caution because its setup instructions install mutable third-party packages.

Before installing, pin or verify the CellCog skill and SDK version, install in a least-privileged environment, and avoid sending confidential legal material unless CellCog's data handling terms meet your needs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:185

Finding

Unpinned Third-Party Dependencies Enable Supply-Chain Compromise

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 185–188
Vulnerability Type: Unpinned and externally retrieved dependencies
Risk Level: Medium

Vulnerable Code

markdown

**Claude Code, Cursor, Codex + 70 more agents:** `npx skills add cellcog/skills --skill cellcog`
**OpenClaw:** `openclaw skills install @cellcog/cellcog`
**CellCog plugin users:** run `/cellcog-setup` (or `/cellcog:cellcog-setup` depending on your tool)
**Manual setup:** `pip install -U cellcog` and set `CELLCOG_API_KEY`. See the **cellcog** skill for SDK reference.

Technical Analysis

The documented setup procedures retrieve mutable third-party components without pinning a reviewed version, immutable commit, or package hash. In particular, pip install -U cellcog explicitly selects an available newer release, while the npx and OpenClaw installation commands similarly provide no immutable version or integrity constraint.

The retrieved implementations are not included in this project, so their behavior cannot be verified by auditing SKILL.md. A compromised publisher account, source repository, package registry, or future package release could consequently change the code installed by these commands after this skill has been reviewed.

This issue does not establish that the current CellCog packages are malicious. The vulnerability is the reliance on mutable, unverified dependency sources, which creates a supply-chain attack opportunity.

Attack Path

1. An attacker compromises a relevant package publisher account, repository, registry entry, or release pipeline.
2. The attacker publishes a malicious package version under the expected package identity.
3. A user follows one of the unpinned installation instructions in SKILL.md.
4. The package manager resolves and downloads the attacker-controlled release because no reviewed version, commit, or integrity hash is required.
5. Malicious code executes during instal ...[truncated 790 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency and skill to an explicitly reviewed version rather than resolving the latest release.
2. For repository-based installation, reference an immutable commit hash instead of a mutable branch or tag.
3. Publish and verify cryptographic hashes for downloaded artifacts. For Python deployments, use a locked requirements file and hash enforcement such as pip install --require-hashes -r requirements.txt.
4. Remove the unconditional -U upgrade behavior from the documented installation path.
5. Identify the canonical registries and repositories explicitly, and instruct users to reject unexpected mirrors or similarly named packages.
6. Review new releases before updating pinned versions and use automated dependency provenance, signature, and vulnerability checks where supported.
7. Perform installation under a least-privileged account in an isolated environment, such as a dedicated virtual environment or container.
8. Avoid exposing production credentials, including CELLCOG_API_KEY, to package installation processes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The skill instructs users to run npx skills add cellcog/skills --skill cellcog without pinning a specific package or version. This causes execution of whatever package/version is currently resolved from the registry, creating a supply-chain risk if the package is updated maliciously, compromised, or unexpectedly changed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.