Insta Cog

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a coherent CellCog social-content generation skill, with the main considerations being its required CellCog API key and external agent-based processing.

Before installing, make sure you trust CellCog, review the referenced CellCog SDK/skill, use a scoped API key where possible, and avoid putting confidential personal or business information into prompts unless you are comfortable with CellCog processing it.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Using the skill may consume or act under the user's CellCog account/API entitlement.

Why it was flagged

The skill requires a CellCog API key, which is expected for the service, but it is still a sensitive account credential and the registry does not identify it as a primary credential.

Skill content

Required env vars: CELLCOG_API_KEY ... Primary credential: none ... Capability signals: requires-sensitive-credentials

Recommendation

Use a dedicated or scoped CellCog API key if available, monitor usage/billing, and revoke the key if the skill is no longer needed.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The actual API client behavior depends on the external CellCog SDK/skill rather than code included in this package.

Why it was flagged

The skill relies on an external CellCog dependency and a separate CellCog skill for runtime details; that is coherent with the purpose but means important behavior is outside this artifact.

Skill content

dependencies: [cellcog] ... read the **cellcog** skill for the full SDK reference

Recommendation

Review the CellCog SDK/skill provenance and documentation before providing credentials or sensitive prompts.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Brand details, drafts, personal data, or other sensitive content placed in prompts may be processed by CellCog's external service/agents.

Why it was flagged

User prompts are sent into CellCog agent workflows, and the skill also recommends an agent-team mode for more complex content tasks.

Skill content

result = client.create_chat(prompt="[your task prompt]", ... chat_mode="agent") ... Use `"agent team"` for campaign-level thinking

Recommendation

Avoid including confidential or regulated data unless you trust CellCog's data handling, retention, and privacy terms.