Nano Banana Image

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:52 PM UTC
• Version: 1.0.14

Overview

This is a disclosed CellCog image-generation skill; the main caution is unpinned third-party install guidance and API-key use, not hidden or destructive behavior.

Install only from the official CellCog/OpenClaw sources, prefer pinned versions or a reviewed environment when possible, and provide CELLCOG_API_KEY only where the CellCog runtime needs it. Treat prompts and uploaded reference images as data shared with the CellCog service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:136

Finding

Unpinned Third-Party Installation Instructions Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 136-139
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

text

**Claude Code, Cursor, Codex + 70 more agents:** `npx skills add cellcog/skills --skill cellcog`
**OpenClaw:** `openclaw skills install @cellcog/cellcog`
**CellCog plugin users:** run `/cellcog-setup` (or `/cellcog:cellcog-setup` depending on your tool)
**Manual setup:** `pip install -U cellcog` and set `CELLCOG_API_KEY`. See the **cellcog** skill for SDK reference.

Technical Analysis

The skill recommends installing third-party components through npx, OpenClaw's package installer, and pip without pinning an exact version, validating a cryptographic hash, or identifying a reviewed immutable artifact. In particular, pip install -U cellcog explicitly requests the latest available release.

Consequently, the code installed when these instructions are followed can differ from the code originally reviewed. A compromised publisher account, package registry, upstream repository, or future malicious release could cause an agent or user to retrieve unsafe content. Package installation may also invoke package-manager lifecycle or build behavior, while an installed skill can introduce additional instructions not present in this audited project.

The audited file does not itself contain a malicious payload, and there is no evidence in the available project that the named packages are malicious. The finding concerns the absence of dependency pinning and integrity verification.

Attack Path

1. An attacker compromises an upstream CellCog package, repository, publisher account, or distribution channel.
2. The attacker publishes a malicious release under the dependency name referenced by the installation instructions.
3. A user or agent follows one of the documented commands, particularly the unpinned upgrade command.
4. The package manager resolves and downloads the attack ...[truncated 828 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every dependency and skill to an explicitly reviewed version rather than installing or upgrading to the latest release.
• Where supported, reference immutable commit identifiers or package artifacts with verified cryptographic hashes.
• Replace pip install -U cellcog with a reviewed exact-version installation and require hash verification through a locked requirements file.
• Maintain a lockfile or signed manifest recording package versions, artifact hashes, sources, and review status.
• Document the expected official registry and publisher identity to reduce dependency-confusion and package-spoofing risk.
• Disable or review package lifecycle and source-build behavior where the relevant package manager permits it.
• Install dependencies in an isolated, least-privileged environment without unrelated credentials.
• Do not expose CELLCOG_API_KEY during installation; provide it only to the reviewed runtime component that requires it.
• Re-audit upstream releases before updating pinned versions.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill instructs users to run npx skills add cellcog/skills --skill cellcog without pinning a specific package or version, which can cause execution of whatever package version is currently resolved at install time. If the upstream package, dependency chain, or publishing account is compromised, users could execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.