Research Cog

ReviewAudited by ClawScan on May 1, 2026.

Overview

This instruction-only research skill is coherent, but users should know it sends research prompts to CellCog and uses a CellCog API key and remote agent/team workflows.

This appears aligned with its stated purpose. Before installing, make sure you trust CellCog, use a revocable API key, and do not submit confidential research prompts unless CellCog's data handling terms are acceptable to you.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Using the skill may consume CellCog account credits or access capabilities tied to the API key.

Why it was flagged

The skill requires a CellCog API key, which is expected for using the CellCog service but gives the skill/provider access to the user's CellCog account authorization.

Skill content

requires:
      bins: [python3]
      env: [CELLCOG_API_KEY]

Recommendation

Use a dedicated, revocable CellCog API key with the minimum access available, and rotate or revoke it if you stop using the skill.

Medium

#ASI07: Insecure Inter-Agent Communication

What this means

Sensitive business, investment, academic, or due-diligence prompts may be processed by the external CellCog service and remote agent workflow.

Why it was flagged

The documented workflow sends the user's prompt to CellCog and can notify the OpenClaw session asynchronously, so research inputs and outputs cross a provider/session boundary.

Skill content

result = client.create_chat(
    prompt="[your task prompt]",
    notify_session_key="agent:main:main",
    task_label="my-task",
    chat_mode="agent",
)

Recommendation

Avoid including confidential material unless you are comfortable with CellCog processing it, and review CellCog's privacy, retention, and data-use terms.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The safety and behavior of actual execution depends on the external CellCog SDK/service and referenced skill, not just this SKILL.md file.

Why it was flagged

The skill is instruction-only and delegates functionality to the external CellCog dependency and a separate cellcog skill/SDK reference.

Skill content

dependencies: [cellcog]
...
For your first CellCog task in a session, read the **cellcog** skill for the full SDK reference

Recommendation

Install CellCog only from trusted sources and review the separate cellcog skill or SDK documentation before using it for sensitive research.

Low

#ASI10: Rogue Agents

What this means

A research task may keep running remotely and later notify the session rather than completing immediately.

Why it was flagged

The skill documents an asynchronous fire-and-forget workflow, which is disclosed and purpose-aligned for long-running research but may continue remotely after the initial call.

Skill content

**OpenClaw (fire-and-forget):**
```python
result = client.create_chat(

Recommendation

Use clear task labels, monitor long-running jobs, and avoid starting broad or expensive research tasks unintentionally.