Meme Generator

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:47 AM UTC
• Version: 1.0.17

Overview

This is a straightforward CellCog-powered meme generation skill with a supply-chain caution around unpinned install commands.

Before installing, confirm you trust the CellCog publisher and package source, consider pinning a reviewed version instead of installing the latest package, and use a scoped CELLCOG_API_KEY if available. Prompts sent through this skill are intended to go to CellCog for generation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:236

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 236-239
Vulnerability Type: Unpinned and unverified external dependencies
Risk Level: Medium

Vulnerable Code

markdown

**Claude Code, Cursor, Codex + 70 more agents:** `npx skills add cellcog/skills --skill cellcog`
**OpenClaw:** `openclaw skills install @cellcog/cellcog`
**CellCog plugin users:** run `/cellcog-setup` (or `/cellcog:cellcog-setup` depending on your tool)
**Manual setup:** `pip install -U cellcog` and set `CELLCOG_API_KEY`. See the **cellcog** skill for SDK reference.

Technical Analysis

The Skill instructs users to obtain the CellCog dependency from external package or Skill distribution systems without specifying a reviewed version, immutable commit, checksum, or cryptographic signature. The pip install -U cellcog command explicitly selects an available upgrade, while the npx and OpenClaw installation commands similarly do not identify an immutable release.

Consequently, the dependency installed at a future date may differ from the component that existed when this Skill was audited. The external dependency's implementation is not included in this project and therefore could not be assessed as part of the present audit. This creates a supply-chain trust boundary in which a compromised publisher account, package registry, upstream repository, or future malicious release could introduce attacker-controlled code.

This finding does not establish that the current CellCog package is malicious. The vulnerability is the absence of version and integrity controls around executable third-party dependencies.

Attack Path

1. An attacker compromises the relevant upstream publisher account, repository, package registry entry, or release process.
2. The attacker publishes a modified release under the expected CellCog package or Skill identifier.
3. A user follows one of the documented unpinned installation commands.
4. The packa ...[truncated 1248 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin CellCog to a specific reviewed version rather than selecting the latest available release.
2. Where supported, reference an immutable commit hash or content-addressed package artifact.
3. Publish and verify cryptographic hashes or signatures for downloaded artifacts.
4. Use lockfiles with integrity metadata for package ecosystems that support them.
5. Avoid implicit npx resolution; specify an exact, reviewed package version.
6. Document the canonical package registry, publisher identity, and official repository so users can detect dependency-confusion or typosquatting attempts.
7. Review dependency release notes and package contents before updating the pinned version.
8. Install and run the dependency with least privilege in an isolated environment, exposing only the files and environment variables necessary for the task.
9. Scope and rotate CELLCOG_API_KEY credentials where supported, and avoid forwarding unrelated secrets through prompts.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs users to run npx skills add cellcog/skills --skill cellcog without pinning a specific package or version, which can cause retrieval and execution of whatever package/version is currently published or resolved at install time. This creates a supply-chain risk: if the upstream package is compromised, typosquatted, or a breaking/malicious version is published, users may execute untrusted code during installation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.