Brand Cog

PassAudited by ClawScan on May 1, 2026.

Overview

Brand Cog appears purpose-aligned for CellCog-powered brand design, with the main user considerations being the CellCog API key, external agent handoff, and unpinned CellCog dependency.

This skill looks coherent for generating brand assets with CellCog. Before installing or using it, confirm you trust CellCog, verify any CellCog SDK/package source, configure the API key carefully, and avoid sending confidential business details unless you are comfortable with CellCog processing them.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

If a user installs the required CellCog dependency separately, they need to make sure it is the official one.

Why it was flagged

The skill depends on the CellCog SDK/skill but the provided artifacts do not pin a version or include an install specification. This is not suspicious by itself, but users should verify the dependency source.

Skill content

dependencies: [cellcog] ... from cellcog import CellCogClient

Recommendation

Install CellCog only from an official, trusted source and prefer pinned or documented versions when possible.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill can use the configured CellCog account and may consume API credits or access account-scoped capabilities.

Why it was flagged

The skill requires a CellCog API key, which is expected for this service integration but still grants access to the user's CellCog account/API usage.

Skill content

requires: ... env: [CELLCOG_API_KEY]

Recommendation

Use a dedicated or least-privilege API key if available, monitor CellCog usage, and rotate the key if it is exposed.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Brand briefs, business positioning, draft assets, or other prompt contents may be sent to CellCog and processed outside the local environment.

Why it was flagged

The skill sends the user's prompt to CellCog in agent mode and may notify another session asynchronously. This is central to the stated purpose, but it is an external agent/service handoff.

Skill content

**OpenClaw (fire-and-forget):** ... client.create_chat(prompt="[your task prompt]", notify_session_key="agent:main:main", chat_mode="agent")

Recommendation

Avoid including confidential brand strategy or proprietary data unless CellCog's privacy, retention, and sharing terms are acceptable.