Game Cog

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Anyone installing or using the skill must provide a sensitive CellCog credential, so misuse of that key could affect the user's CellCog account.

Why it was flagged

The skill explicitly requires a CellCog API key, which is expected for a CellCog-powered integration but still grants access to the user's CellCog account or quota.

Skill content
requires:\n      bins: [python3]\n      env: [CELLCOG_API_KEY]
Recommendation

Use a dedicated or scoped CellCog API key if available, keep it out of shared logs and prompts, and revoke it if you stop using the skill.

What this means

Game concepts, prompts, and any assets referenced in prompts may be processed by CellCog rather than staying only in the local agent session.

Why it was flagged

The documented workflow sends user prompts to a CellCog agent and notifies an OpenClaw session, which is normal for the skill but creates an external agent/service data flow.

Skill content
result = client.create_chat(\n    prompt="[your task prompt]",\n    notify_session_key="agent:main:main",\n    task_label="my-task",\n    chat_mode="agent",\n)
Recommendation

Avoid including confidential or proprietary game materials unless you are comfortable sharing them with CellCog under its terms and privacy practices.

What this means

Actual behavior may depend on the separately installed CellCog SDK or skill documentation used at runtime.

Why it was flagged

The skill relies on a referenced CellCog dependency/skill that is not included in this artifact, creating a provenance item for the user to verify. There is no evidence of automatic installation or execution in this artifact.

Skill content
dependencies: [cellcog]\n...\nFor your first CellCog task in a session, read the **cellcog** skill for the full SDK reference
Recommendation

Verify the CellCog package/skill source and documentation before providing credentials or running generation tasks.