News Cog

ReviewAudited by ClawScan on May 1, 2026.

Overview

News Cog appears purpose-aligned for CellCog-powered news briefings, but it requires a CellCog API key and sends prompts to an external agent service.

This looks like a coherent CellCog news integration. Before installing, confirm you trust CellCog, use an appropriate API key, and avoid sending secrets or highly sensitive internal information in news-research prompts.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Installing and using the skill may let the agent access the user's CellCog account according to the permissions of the API key.

Why it was flagged

The skill explicitly requires a CellCog API key, which is expected for the service integration but is still a sensitive credential.

Skill content

requires:
      bins: [python3]
      env: [CELLCOG_API_KEY]

Recommendation

Use a dedicated or scoped CellCog API key if available, rotate it if exposed, and avoid giving the skill credentials unrelated to CellCog news tasks.

Medium

#ASI07: Insecure Inter-Agent Communication

What this means

News prompts may include business priorities, competitors, or other sensitive context that will be processed by the external CellCog service.

Why it was flagged

The usage pattern sends the user's task prompt to CellCog and can notify the main agent session when the remote task completes.

Skill content

result = client.create_chat(
    prompt="[your task prompt]",
    notify_session_key="agent:main:main",
    task_label="my-task",
    chat_mode="agent",
)

Recommendation

Only include information in CellCog prompts that you are comfortable sending to that provider, and avoid secrets or private business details unless necessary.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The safety of actual execution also depends on the CellCog SDK/skill that the user has installed or imports.

Why it was flagged

The skill depends on the external CellCog component, while the reviewed artifact itself is instruction-only and does not include that dependency's implementation.

Skill content

dependencies: [cellcog]

Recommendation

Use the official CellCog package or skill from a trusted source and keep it updated.