Fin Cog

PassAudited by ClawScan on May 1, 2026.

Overview

Fin Cog is a coherent CellCog-powered finance analysis skill, but users should notice that it requires a CellCog API key and may send sensitive financial information to an external agent service.

Before installing, be comfortable using CellCog as an external processor for financial prompts, protect the CELLCOG_API_KEY, verify the CellCog dependency/source, and treat generated financial outputs as research rather than professional advice.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

CellCog usage may be associated with or billed to the user's account, and mishandling the API key could affect that account.

Why it was flagged

The skill requires a CellCog API key. This is expected for using the CellCog service, but it means requests are made under the user's CellCog credential.

Skill content

requires:
      bins: [python3]
      env: [CELLCOG_API_KEY]

Recommendation

Use a dedicated or scoped CellCog API key if available, keep it out of prompts and shared files, and monitor account usage.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Private financial details may leave the local agent environment and be processed by CellCog's external service.

Why it was flagged

The documented workflow sends the user's task prompt to CellCog for agentic processing. The same artifact gives examples involving portfolios, taxes, mortgages, debt, and business financial reports, which can contain sensitive personal or business data.

Skill content

result = client.create_chat(
    prompt="[your task prompt]",
    ...
    chat_mode="agent",
)

Recommendation

Only include financial data you are comfortable sending to CellCog, redact unnecessary identifiers, and review CellCog's privacy, retention, and sharing policies.

NoteMedium Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The safety of actual execution depends partly on the CellCog SDK/skill that this artifact references.

Why it was flagged

The skill relies on an external CellCog dependency/reference that is not included in the provided artifact set. This is expected for a provider integration, but the artifact does not pin or show the referenced dependency contents.

Skill content

dependencies: [cellcog]
...
For your first CellCog task in a session, read the **cellcog** skill for the full SDK reference

Recommendation

Install CellCog components only from trusted sources and verify the referenced CellCog skill or SDK before using it with sensitive data.

NoteHigh Confidence

ASI09: Human-Agent Trust Exploitation

What this means

Users may place too much trust in generated investment, tax, or financial planning outputs.

Why it was flagged

The artifact uses strong authority and performance language in a high-stakes financial context. This is marketing aligned with the product, but it can encourage overreliance on AI-generated financial analysis.

Skill content

**Wall Street-grade analysis, accessible globally.** ... #1 on DeepResearch Bench ... High-stakes investment decisions, M&A due diligence

Recommendation

Treat outputs as research support, not as a substitute for licensed financial, tax, legal, or investment advice.