Video Cog

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Anyone using the skill must provide a CellCog API key, which may authorize API usage and possible account billing.

Why it was flagged

The skill requires a CellCog API key. This is expected for a CellCog video-generation integration, but it is still sensitive account access.

Skill content
requires:\n      bins: [python3]\n      env: [CELLCOG_API_KEY]
Recommendation

Use a dedicated or scoped CellCog API key if available, keep it out of prompts and logs, and review CellCog account limits before use.

What this means

Private scripts, marketing plans, product details, or other prompt content may be processed by CellCog and its model orchestration workflow.

Why it was flagged

The artifact directs prompts to CellCog chat/agent-team workflows. This is central to the stated video-generation purpose, but it means user-provided task content is shared with an external provider workflow.

Skill content
result = client.create_chat(\n    prompt="[your task prompt]",\n    notify_session_key="agent:main:main",\n    task_label="my-task",\n    chat_mode="agent",\n) ... For video generation, always use `chat_mode="agent team"`
Recommendation

Avoid including confidential or regulated data unless CellCog’s data handling terms, retention, and access controls are acceptable.

What this means

The skill may rely on a separately installed CellCog component, so users should ensure they are using the intended trusted package or companion skill.

Why it was flagged

The instruction-only skill depends on an external CellCog SDK or companion dependency, but the supplied artifacts do not include package provenance or a pinned install specification. There is no evidence of automatic installation or hidden execution.

Skill content
dependencies: [cellcog] ... from cellcog import CellCogClient
Recommendation

Install CellCog only from the official source documented by the provider and review the companion dependency before granting credentials.