T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:17- Finding
Auto-Approved Cloud Agent Commands Permit Unattended Local Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Pair Programming
Security checks for vulnerabilities and agentic risk
Overview
This skill is for remote AI pair programming, but it gives cloud agents broad unattended control over local commands, files, installation steps, and possibly a real browser profile.
Install only if you intentionally want CellCog cloud agents to operate on your machine without per-command prompts. Use a disposable or tightly scoped project directory, avoid workspaces containing secrets, do not grant access to personal browser profiles or sensitive repositories, and prefer manually verifying any desktop installer, version, signature, and command before running it.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:94- Finding
Server-Provided Installation Commands Can Introduce a Mutable Remote Payload
- Content
View full analysis
``` The unattended-execution recommendation is reinforced at lines 128-136: ```markdown Call `client.get_desktop_download_urls()` — returns download URLs and platform-specific install commands for macOS, Windows, and Linux. After installation: ```bash cellcog-desktop --set-api-key cellcog-desktop --start ``` The agent can do all of this programmatically — no human interaction needed beyond providing the API key. ``` ### Technical Analysis The Skill directs an agent to retrieve platform-specific download URLs and installation commands from an external API. Those commands and referenced binaries are not fixed in the reviewed Skill, so their effective behavior can change after review. The document also states that installation may be performed programmatically without human interaction. If the API response, delivery service, publisher account, SDK, or network trust chain is compromised, the returned command may install and execute attacker-controlled software. The repository does not specify an immutable version, expected cryptographic digest, signature identity, permitted installer syntax, or local validation process. This is a remote-payload risk because the security-relevant executable content is resolved at runtime rather than being available for static review. ### Attack Path 1. The desktop status check reports that the application is not connected. 2. The agent invokes `get_desktop_download_urls()`. 3. A compromised service, dependency, distribution account, or delivery endpoint supplies a modifi ...[truncated 982 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:27- Finding
Third-Party Skill Dependencies Are Installed Without Immutable Version Pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 98% confidence
- Finding
The description advertises terminal access, file operations, and full development workflows as 'auto-approved for agents,' normalizing autonomous code execution on the user's machine without manual checkpoints. In the context of a skill that bridges cloud agents to a local desktop app, this creates a highly dangerous trust boundary where prompt mistakes, malicious tasks, or compromised upstream agents can directly alter the host system.
- Content
md --- name: pair-programming-cellcog description: "AI pair programming powered by CellCog Desktop. Code, debug, refactor, and build directly on the user's machine. Terminal access, file operations, full development workflows — auto-approved for agents." author: CellCog homepage: https://cellcog.ai metadata:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly enables cloud agents to run commands, read files, and write code on the user's machine with auto-approval, but it does not present a prominent warning about the system and data impact of that autonomy. In this context, omission is dangerous because users or upstream agents may invoke the skill without understanding that local files and execution are being delegated to a remote service with broad machine access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file describes local machine data being explored and reasoned over by CellCog cloud agents, yet it lacks a direct warning that project contents, logs, configs, and other local data may be transmitted to or processed by a cloud service. That omission materially increases privacy and confidentiality risk, especially because the skill is marketed as fully autonomous and suitable for broad coding workflows.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 99% confidence
- Finding
This line states that all commands are auto-approved and fully autonomous with no manual approval needed, while the surrounding text grants command execution and file access on the user's machine. That combination substantially increases the blast radius of prompt injection, task misinterpretation, or remote service compromise, because destructive actions can occur immediately on the local host.
- Content
md Co-work turns any machine into CellCog's workspace. CellCog Desktop acts as a bridge: CellCog's cloud agents coordinate with the desktop app to run commands, read files, and write code directly on the user's machine. All commands are **auto-approved** for SDK/agent users — fully autonomous, no manual approval needed. ## Prerequisites
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 96% confidence
- Finding
Although presented in a security section, 'Even with auto-approve' confirms that autonomous execution remains the operating mode and may create false confidence that listed protections are sufficient. The claimed blocked paths and redaction controls do not eliminate risks such as destructive edits, access to adjacent sensitive project data, abuse of available developer tooling, or indirect secret exposure through allowed directories.
- Content
md ## Security Even with auto-approve, these protections are always active: - **Blocked paths**: `~/.ssh`, `~/.aws`, credential files are inaccessible - **Output redaction**: Sensitive data is automatically redacted from command output - **Per-chat scoping**: Each chat session is scoped to its working directory
Static analysis
No suspicious patterns detected.