Music Generation

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:49 AM UTC
• Version: 1.0.15

Overview

This skill is a straightforward CellCog music-generation guide, with a supply-chain caution because its optional install commands are not pinned to fixed versions.

Before installing, verify you trust the CellCog publisher and package source, prefer pinned versions or reviewed releases when available, and avoid running the setup in an environment containing unrelated secrets. Using the skill requires a CellCog API key and sends music-generation prompts to CellCog.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:166

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 166-169
Vulnerability Type: Supply-chain risk from mutable, unpinned dependencies
Risk Level: Medium

Vulnerable Code

text

**Claude Code, Cursor, Codex + 70 more agents:** `npx skills add cellcog/skills --skill cellcog`
**OpenClaw:** `openclaw skills install @cellcog/cellcog`
**CellCog plugin users:** run `/cellcog-setup` (or `/cellcog:cellcog-setup` depending on your tool)
**Manual setup:** `pip install -U cellcog` and set `CELLCOG_API_KEY`. See the **cellcog** skill for SDK reference.

Technical Analysis

The setup instructions install or upgrade third-party packages without specifying an immutable version, lockfile, or integrity hash. Consequently, the code executed by these commands can change after this Skill has been reviewed.

In particular, pip install -U cellcog explicitly upgrades to the latest package version available from the configured Python package index. The npx and OpenClaw installation commands similarly do not identify a reviewed version. Package installation may execute package lifecycle hooks, while subsequently importing the installed SDK executes its Python code. The actual dependency contents are not included in this project and therefore could not be audited.

This is a supply-chain weakness rather than evidence that the current CellCog packages are malicious. Exploitation depends on compromise of a package publisher, registry account, distribution infrastructure, or transitive dependency.

Attack Path

1. An attacker compromises a referenced package, its publisher account, its release process, or a transitive dependency.
2. The attacker publishes a malicious release under the package identifier used by the documented command.
3. A user follows the Skill's unpinned setup instructions.
4. The package manager retrieves the latest mutable release rather than a previously reviewed version.
5. Malicious code e ...[truncated 878 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency and Skill installation to a specific version that has been reviewed, rather than implicitly installing the latest release.
2. Use cryptographic hashes or signed release verification where supported. For Python, provide a requirements file with exact versions and hashes and install it with hash enforcement.
3. Supply and maintain lockfiles for all package ecosystems involved, including transitive dependencies.
4. Remove -U from the default installation command so installation does not silently replace a reviewed version with an unreviewed release.
5. Document the expected package publisher, registry, package identifier, version, and release checksum so users can verify provenance.
6. Review new releases before updating pinned versions, including installation hooks and transitive dependency changes.
7. Perform installation in an isolated, least-privileged environment and avoid exposing unrelated secrets during installation or first import.
8. Consider vendoring or otherwise distributing the exact reviewed integration code when reproducible package resolution cannot be guaranteed.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to run npx skills add cellcog/skills --skill cellcog without pinning an exact package version. This can cause users to fetch and execute whatever version is current at install time, increasing supply-chain risk if a future release is compromised, maliciously updated, or unexpectedly changed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.