Tube Cog

PassAudited by ClawScan on May 1, 2026.

Overview

Tube Cog is a coherent YouTube-content skill that delegates work to CellCog, but users should notice it requires a CellCog API key and can start external agent-style generation tasks.

This skill appears purpose-aligned for creating YouTube content with CellCog. Before installing, make sure you trust CellCog, use a controlled API key, and avoid sending confidential scripts, brand plans, or private assets unless you are comfortable with them being processed by the external service.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing or using the skill may require giving the agent access to a CellCog account/API credential.

Why it was flagged

The skill requires a CellCog API key, which is expected for a CellCog-powered content-generation service but is still a sensitive credential.

Skill content
requires:\n      bins: [python3]\n      env: [CELLCOG_API_KEY]
Recommendation

Use a dedicated, least-privileged CellCog API key if available, and revoke or rotate it if you stop using the skill.

What this means

The reviewed artifact mainly provides instructions, so actual runtime behavior depends on the separate CellCog SDK or skill installed in the environment.

Why it was flagged

The skill relies on an external CellCog dependency/skill for the actual SDK behavior; that dependency is central to the purpose but not included as code in this artifact.

Skill content
dependencies: [cellcog]
Recommendation

Install CellCog only from a trusted source and review its permissions and documentation before providing credentials.

What this means

Prompts, creative briefs, and any assets or instructions included in the task may be sent to CellCog for processing.

Why it was flagged

The documented workflow sends the user's task prompt to a CellCog chat/agent session and uses a notification session key; this is purpose-aligned but involves an external agent/provider boundary.

Skill content
result = client.create_chat(\n    prompt="[your task prompt]",\n    notify_session_key="agent:main:main",\n    task_label="my-task",\n    chat_mode="agent",\n)
Recommendation

Avoid sending private or confidential material unless you trust CellCog’s handling of that data and its retention policy.

NoteMedium Confidence
ASI10: Rogue Agents
What this means

A started generation job may run asynchronously through CellCog rather than completing entirely in the current chat turn.

Why it was flagged

The OpenClaw example describes a non-blocking external task flow. This appears aligned with video generation, but users should understand tasks may continue after being started.

Skill content
**OpenClaw (fire-and-forget):**
Recommendation

Start only clearly scoped tasks, label them meaningfully, and monitor CellCog/OpenClaw task results before using or publishing generated content.