Pair Programming

• Outcome: Review
• Latest audit: Aug 24, 2026 · 2:18 AM UTC
• Version: 1.0.15

Overview

This skill openly gives CellCog cloud agents autonomous terminal and file access on a user's machine, which is powerful enough to require careful review before installation.

Install only if you are comfortable letting CellCog's cloud-backed agents inspect and modify the selected local workspace autonomously. Use a narrow working directory, avoid repositories containing secrets or regulated data, and understand that the desktop bridge and API key enable powerful local actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly enables cloud-coordinated agents to run commands, read files, and write code directly on the user's machine with auto-approval, but it does not present a prominent user-facing warning about the operational risk of autonomous local execution. This is dangerous because users or downstream agents may invoke it without understanding that it can modify the system, execute arbitrary development workflows, and affect local data and state.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that CellCog cloud agents coordinate with the desktop app to explore, read, and reason about local project data, yet it lacks a clear privacy disclosure that local files and possibly sensitive project contents may be accessed and processed by a cloud-backed service. This creates a meaningful privacy and data-governance risk, especially for proprietary code, credentials in project trees, logs, or regulated data.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

---
name: pair-programming-cellcog
description: "AI pair programming powered by CellCog Desktop. Code, debug, refactor, and build directly on the user's machine. Terminal access, file operations, full development workflows — auto-approved for agents."
author: CellCog
homepage: https://cellcog.ai
metadata:

• Confidence: 93% confidence
• Finding: The skill metadata advertises 'auto-approved for agents' in the description, encouraging fully autonomous operation without human review. In the context of terminal access and file operations on the user's machine, this increases the chance of unsafe or unintended actions being taken automatically, including destructive commands, persistence changes, or exposure of local data.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Co-work turns any machine into CellCog's workspace. CellCog Desktop acts as a bridge: CellCog's cloud agents coordinate with the desktop app to run commands, read files, and write code directly on the user's machine.

All commands are **auto-approved** for SDK/agent users — fully autonomous, no manual approval needed.

## Prerequisites

• Confidence: 98% confidence
• Finding: The statement that all commands are auto-approved and fully autonomous with no manual approval needed is a direct unsafe capability escalation. Given the skill's purpose of local command execution and code modification, this materially increases the blast radius of prompt mistakes, malicious prompts, or compromised upstream agent behavior.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Security

Even with auto-approve, these protections are always active:
- **Blocked paths**: `~/.ssh`, `~/.aws`, credential files are inaccessible
- **Output redaction**: Sensitive data is automatically redacted from command output
- **Per-chat scoping**: Each chat session is scoped to its working directory

• Confidence: 88% confidence
• Finding: Although this section presents security controls, it normalizes operation 'with auto-approve' and may overstate safety by implying the listed protections sufficiently mitigate autonomous execution risk. Blocked paths, output redaction, and working-directory scoping do not eliminate the risk of harmful commands, data exfiltration from allowed paths, or damaging changes within the scoped project.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.