ClawHub
Back to skill

Security audit

News Briefing

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent CellCog news-briefing integration, but users should understand that prompts go to CellCog and installation depends on unpinned external packages.

Install only from CellCog sources you trust, prefer a pinned or reviewed version if your environment requires change control, keep CELLCOG_API_KEY in secret-management or environment storage, and do not send confidential, regulated, or credential-bearing task content to CellCog unless that data flow is approved.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:169
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 11 and lines 169–175
Vulnerability Type: Unpinned and unauditable third-party dependencies
Risk Level: Medium

Vulnerable Code

yaml
dependencies: [cellcog]
markdown
## If CellCog is not installed

**Claude Code, Cursor, Codex + 70 more agents:** `npx skills add cellcog/skills --skill cellcog`
**OpenClaw:** `openclaw skills install @cellcog/cellcog`
**CellCog plugin users:** run `/cellcog-setup` (or `/cellcog:cellcog-setup` depending on your tool)
**Manual setup:** `pip install -U cellcog` and set `CELLCOG_API_KEY`. See the **cellcog** skill for SDK reference.

Technical Analysis

The skill instructs users to install the cellcog dependency from external package or skill registries without specifying an immutable version, commit, integrity hash, or lockfile. The pip install -U cellcog command explicitly resolves and installs the latest available release.

Because the project contains only SKILL.md, the dependency's installation hooks and runtime implementation cannot be audited from the supplied artifact. A future or compromised upstream release could therefore differ from the version originally reviewed. This creates a supply-chain trust boundary in which registry-account compromise, upstream repository compromise, or an unexpectedly changed release could introduce executable code.

The audit found no evidence that the current cellcog package is malicious. The vulnerability is the unsafe, mutable dependency acquisition process rather than a confirmed malicious payload.

Attack Path

  1. An attacker compromises an upstream publisher account, package registry entry, distribution channel, or repository used by one of the documented installation commands.
  2. The attacker publishes a modified release containing malicious installation hooks or runtime behavior.
  3. A user follows the documented setup instructions, such as `p ...[truncated 1059 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to a specific, reviewed version instead of installing the latest release automatically.
  2. Provide a lockfile or package-manager constraints file containing cryptographic hashes for all resolved artifacts and transitive dependencies.
  3. For repository-based installation, reference a reviewed immutable commit rather than a mutable branch or tag.
  4. Remove -U from the default installation command so installation does not silently upgrade to an unreviewed release.
  5. Verify package publisher identities and document the expected official registry and repository URLs.
  6. Review the dependency's source code, installation hooks, and transitive dependency tree before approving a version.
  7. Run installation and execution in a least-privilege sandbox with restricted filesystem, credential, and network access.
  8. Establish an explicit update-review process so dependency upgrades require integrity verification and security approval before deployment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill clearly sends prompts to the external CellCog service, but the user-facing description and usage guidance do not prominently warn that task contents may leave the local environment. Users may unknowingly transmit sensitive internal data, credentials, or regulated information to a third-party provider during news research tasks.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill instructs users to run npx skills add cellcog/skills --skill cellcog without pinning a specific package or version. That creates a supply-chain risk because users may fetch whatever version is current at execution time, including a compromised or malicious update, and this is especially sensitive in a skill-installation context where code may be executed locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The metadata declares use of CELLCOG_API_KEY but does not warn users that the credential is sensitive or provide safe handling expectations. While this omission does not itself expose the key, it increases the chance of accidental disclosure through logs, prompts, screenshots, or insecure environment management.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.