3d Cog

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent CellCog 3D-generation integration, but it uses a CellCog API key, an external SDK/service, and remote agent-style tasks that users should understand before sending files.

This skill appears suitable if you intend to use CellCog for 3D model generation. Before installing, verify the CellCog SDK/source, protect the CELLCOG_API_KEY, and avoid submitting confidential images, spreadsheets, or product data unless you are comfortable sharing them with CellCog's service.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Anyone using the skill must provide a CellCog credential, so generated tasks may be associated with that account.

Why it was flagged

The skill requires a CellCog API key, which gives the integration authority to act under the user's CellCog account. This is expected for the stated service integration and is clearly disclosed.

Skill content

requires:
      bins: [python3]
      env: [CELLCOG_API_KEY]

Recommendation

Use a dedicated or least-privileged CellCog API key if available, keep it out of prompts and logs, and revoke it if you stop using the skill.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Prompts and any user-selected reference files may be processed by CellCog's remote service and returned asynchronously.

Why it was flagged

The skill uses CellCog chat tasks with an agent mode and an OpenClaw notification session key. This indicates communication between the local agent session and an external CellCog agent workflow.

Skill content

result = client.create_chat(
    prompt="[your task prompt]",
    notify_session_key="agent:main:main",
    task_label="my-task",
    chat_mode="agent",
)

Recommendation

Send only files and prompts you intend to share with CellCog, and review CellCog's privacy and retention terms for confidential product images or datasets.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The actual SDK or referenced CellCog skill may define important runtime behavior such as file handling, timeouts, and network calls.

Why it was flagged

The skill depends on an external CellCog SDK/skill that is not included in the provided artifact set. The dependency is disclosed and aligned with the purpose, but its provenance should be verified.

Skill content

dependencies: [cellcog]

For your first CellCog task in a session, read the **cellcog** skill for the full SDK reference

Recommendation

Install the CellCog SDK/skill only from a trusted source, verify package provenance, and review the referenced SDK documentation before sending sensitive files.