Cine Cog

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing or using the skill requires trusting it and the CellCog SDK with a sensitive API key that may consume account quota or access account resources.

Why it was flagged

The skill requires a CellCog API key, which is expected for a CellCog service integration but still grants account-level service access.

Skill content
requires:\n      bins: [python3]\n      env: [CELLCOG_API_KEY]
Recommendation

Use a scoped CellCog key if available, monitor usage, and avoid sharing the key in prompts or generated outputs.

What this means

Prompts, creative briefs, and any referenced project details may be processed outside the local agent environment by CellCog.

Why it was flagged

The documented workflow sends the user's task prompt to a CellCog agent/service and routes notifications back to an OpenClaw session.

Skill content
result = client.create_chat(\n    prompt="[your task prompt]",\n    notify_session_key="agent:main:main",\n    task_label="my-task",\n    chat_mode="agent",\n)
Recommendation

Do not include confidential scripts, unreleased brand material, private media, or secrets unless CellCog's handling terms meet your needs.

What this means

The security of actual execution depends on the CellCog package or referenced CellCog skill that is installed in the user's environment.

Why it was flagged

The skill depends on the CellCog dependency/SDK, while this artifact set is instruction-only and does not include install code or pinned package details.

Skill content
dependencies: [cellcog]
Recommendation

Install CellCog components only from the official CellCog source and pin or review versions in managed environments.

NoteHigh Confidence
ASI10: Rogue Agents
What this means

A generation job may continue after the initial request rather than blocking locally, potentially consuming service quota until it completes.

Why it was flagged

The skill explicitly documents an asynchronous fire-and-forget mode for provider-side work, which is purpose-aligned for long-running video generation but should be user-directed.

Skill content
**OpenClaw (fire-and-forget):**
Recommendation

Start jobs only when intended, use clear task labels, and rely on CellCog cancellation/timeout controls where available.