Tutoring

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:47 AM UTC
• Version: 1.0.17

Overview

This is a broad tutoring skill that uses CellCog for educational prompts, with normal setup cautions but no hidden or destructive behavior found.

Install CellCog only from a source you trust, prefer pinned or reviewed versions when possible, and avoid running setup commands with unnecessary administrative privileges. Prompts sent through this skill may go to CellCog, so do not include private material unless that is acceptable for your use case.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:280

Finding

Unpinned Third-Party Dependencies and Installers

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 280–284
Vulnerability Type: Unpinned third-party dependencies and mutable installation sources
Risk Level: Medium

text

## If CellCog is not installed

**Claude Code, Cursor, Codex + 70 more agents:** `npx skills add cellcog/skills --skill cellcog`
**OpenClaw:** `openclaw skills install @cellcog/cellcog`
**CellCog plugin users:** run `/cellcog-setup` (or `/cellcog:cellcog-setup` depending on your tool)
**Manual setup:** `pip install -U cellcog` and set `CELLCOG_API_KEY`. See the **cellcog** skill for SDK reference.

Technical Analysis

The documented installation methods retrieve mutable third-party packages without specifying a reviewed version, immutable commit, checksum, or cryptographic signature. The npx workflow invokes an unpinned package-based installer, while openclaw skills install and pip install -U cellcog resolve the package available from their respective upstream sources at installation time.

Consequently, the code installed by these commands can differ from the code that was available when this Skill was audited. An attacker who compromises an upstream repository, package registry account, maintainer account, or release pipeline could publish a malicious release that is subsequently selected by these commands. The use of -U explicitly requests an upgrade and can replace an already reviewed installation with a newer, potentially compromised version.

No evidence establishes that the current CellCog package is malicious. The vulnerability is the lack of dependency pinning and integrity verification, which leaves installation behavior dependent on mutable supply-chain resources.

Attack Path

1. An attacker compromises a relevant upstream package, repository, maintainer account, or publishing pipeline.
2. The attacker publishes a malicious release under the expected CellCog package or Skill identity.
3. A user follows one ...[truncated 1152 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every dependency and installer to a specifically reviewed version or immutable commit hash.
• Replace pip install -U cellcog with a version-pinned installation such as pip install cellcog==REVIEWED_VERSION.
• Use hash-verified Python requirements, for example a locked requirements file installed with pip install --require-hashes -r requirements.txt.
• Pin the package providing the npx installer and avoid implicitly executing the latest available release.
• Configure OpenClaw installation to use a reviewed, immutable Skill release where the platform supports version or digest pinning.
• Publish expected checksums or signature-verification instructions and require verification before installation.
• Use lockfiles and a controlled internal package mirror or allowlist for production deployments.
• Perform installation in an isolated, non-administrative environment with minimal filesystem access and no unnecessary credentials.
• Review dependency updates before changing pinned versions rather than recommending automatic upgrades.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest description advertises extremely broad coverage such as 'every subject, every level' for tutoring and education. In a markdown/manifest context, this can function as an ambiguous activation description because it does not define specific trigger phrases, scope limits, or exclusion conditions, increasing the chance of unintended invocation for general help requests.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The skill instructs users to run npx skills add cellcog/skills --skill cellcog without pinning a specific package or version. This creates a supply-chain risk because users may fetch whatever package/version is current at execution time, including a compromised or typosquatted release, and the install command is presented as a setup step users may copy-paste directly.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The text states that CellCog can help with 'virtually any subject' and then lists a very wide range of domains. This broad scope, without constraints or examples of requests that should not trigger the skill, makes activation boundaries unclear and may overlap with many unrelated everyday assistance requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.