Meme Cog

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Using the skill may consume or act through the user's CellCog account/API quota.

Why it was flagged

The skill requires a CellCog API key, which is an account credential. This is expected for a CellCog-powered generation service, and the artifact does not show hardcoded credentials, credential logging, or unrelated credential use.

Skill content

requires:\n      bins: [python3]\n      env: [CELLCOG_API_KEY]

Recommendation

Use a CellCog API key intended for this service, keep it secret, and review any CellCog account permissions or billing implications before use.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Meme prompts, and potentially any images or context included by the user, may be processed by CellCog rather than staying entirely local.

Why it was flagged

The documented workflow sends the user's prompt to CellCog and uses agent chat mode, including a notification session key in the OpenClaw example. This is disclosed and purpose-aligned, but it is still an external/provider-mediated flow.

Skill content

result = client.create_chat(\n    prompt="[your task prompt]",\n    notify_session_key="agent:main:main",\n    task_label="my-task",\n    chat_mode="agent",\n)

Recommendation

Avoid including private, confidential, or sensitive material in meme prompts unless you are comfortable sharing it with CellCog under its terms.