Security audit

CellCog

Security checks across malware telemetry and agentic risk

Overview

This is a coherent CellCog integration, but it needs Review because it broadly auto-routes work to an external AI service and includes sensitive media/data capabilities without enough per-skill guardrails.

Install only if you are comfortable sending task prompts and any SHOW_FILE-attached files to CellCog and possibly downstream model providers. Avoid confidential, regulated, personal, credential, source-secret, internal architecture, or third-party voice/likeness material unless you have approval and consent. Review the CellCog SDK, privacy/retention terms, host OpenClaw version, and API-key handling before enabling broad routing.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The description advertises extremely broad capabilities using phrases like 'Any input, any deliverable,' which can encourage overly permissive routing, invocation, or user trust in the plugin’s scope. While this is not executable code, broad scope language increases the risk that an agent invokes the skill for sensitive or unintended tasks without clear boundaries, especially in an agentic environment handling multimodal content and research workflows.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The manifest description advertises extremely broad capability ('Any input, any deliverable') without defining boundaries, restrictions, or safety constraints. In an agent/plugin ecosystem, this can cause users or the host environment to over-trust the skill, increasing the chance it is invoked for sensitive, high-risk, or unintended tasks beyond what is safely governed.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The manifest description claims the plugin can handle essentially 'any input, any deliverable' across many modalities without defining boundaries, exclusions, or safety constraints. This overbroad invocation language can cause the agent to be selected for tasks beyond its validated scope, increasing the risk of unsafe delegation, inappropriate tool use, or misuse in sensitive contexts.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The plugin description is extremely broad ('Any-to-any AI sub-agent') and enumerates many unrelated capabilities, which creates a large ambiguous trigger surface. In an agent ecosystem, this can cause over-invocation on loosely related user requests, increasing unnecessary data exposure to the external CellCog service and reducing user control over when the plugin is activated.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The manifest requests an API key for an external service but provides no user-facing disclosure that prompts, uploaded content, or derived data may be transmitted to CellCog. This is dangerous because users may unknowingly send sensitive business, personal, or regulated data to a third party, creating privacy, compliance, and data-handling risks.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill instructs users to submit prompts and reference images to CellCog but does not clearly disclose that this data is transmitted to an external third-party service for processing. This can lead users to share sensitive images, proprietary product designs, or confidential prompts without informed consent, creating privacy, confidentiality, and compliance risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly promotes cloned-voice generation via user avatars and gives an example of producing speech in 'my avatar Luna's voice' without any guardrails about consent, identity verification, or anti-impersonation restrictions. In an audio-generation context, this omission materially increases the risk of fraud, social engineering, harassment, and deceptive content creation because voice cloning is a high-abuse capability, not just a neutral media feature.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The manifest description claims an extremely broad capability surface ('any-to-any' across nearly all modalities and tasks) without any activation constraints. In agent environments that select skills by semantic matching, this can cause the skill to be invoked for many ordinary requests, unnecessarily exposing user prompts, local file references, and downstream actions to a third-party service.

Vague Triggers

Low

Confidence: 89% confidence
Finding: The opening positioning language is highly expansive and lacks concrete guardrails for when the skill is appropriate. Because the skill also instructs agents to upload files via SHOW_FILE tags and can generate/download artifacts, overbroad activation increases the chance of accidental data disclosure or unnecessary execution in contexts that do not need this external service.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly encourages users to upload arbitrary datasets and have a third-party service execute analysis code on them, but it provides no warning about privacy, confidentiality, or data-governance risks. Users may submit PII, financial, health, HR, or regulated data without understanding where it is processed, retained, or exposed, which can lead to unauthorized disclosure or compliance violations.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly states that CellCog deploys generated diagrams as interactive web applications accessible by shareable URL, but it does not provide a clear warning near the description or usage guidance that submitted system descriptions, architectures, workflows, or data models may be exposed outside the local environment. Users may unknowingly send sensitive internal topology, security-zone layouts, database schemas, or business processes to a third-party service and publish them via a retrievable link.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The skill description and opening guidance are broad enough that an orchestrator could invoke this skill for general game-development requests far beyond narrowly scoped asset generation. That increases the chance of over-triggering an external service, causing unnecessary data sharing, cost, and execution of a more capable downstream agent workflow than the user explicitly intended.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly encourages reference-based generation using uploaded images and routes requests to third-party providers, but it does not disclose that prompts and uploaded images may be transmitted to external services. This creates a real privacy and data-handling risk because users may supply sensitive images, brand assets, or personal data without informed consent or awareness of external processing.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The manifest description is extremely broad and covers many generic document types and common user intents, which can cause the skill to be invoked in situations where a user did not clearly intend to use an external third-party document-generation service. This increases the chance of over-triggering and unintended routing of sensitive business, legal, or personal content to CellCog.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The guidance explicitly states that ambiguous requests like 'create a report' or 'make a document' default to PDF generation, which encourages the skill to claim generic requests without confirming user intent. In practice, that can result in automatic use of an external service for broadly phrased tasks that may contain confidential information.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs users to submit prompts and document content to CellCog but does not clearly warn that resumes, contracts, reports, legal documents, and other potentially sensitive materials will be sent to an external service. This creates a meaningful data exposure risk because users may unknowingly provide personal, confidential, financial, or legally sensitive information.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill explicitly supports AI spokesperson and lipsync video generation but omits safeguards about consent, likeness rights, and impersonation abuse. That omission can facilitate deceptive media creation, unauthorized use of a person's identity, and downstream legal or reputational harm, especially because the feature is presented as a straightforward capability.

Missing User Warnings

Low

Confidence: 76% confidence
Finding: The instructions tell users to set an API key but provide no warning about secure credential handling. This can lead users to expose secrets in source code, logs, prompts, shared shell history, or screenshots, increasing the chance of account misuse and unauthorized API consumption.

Known Vulnerable Dependency: openclaw==2026.3.24-beta.2 — 10 advisory(ies): CVE-2026-53846 (OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency); CVE-2026-41913 (OpenClaw: Concurrent async auth attempts can bypass the intended shared-secret r); CVE-2026-53830 (OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reloa) +7 more

High

Category: Supply Chain
Confidence: 98% confidence
Finding: openclaw==2026.3.24-beta.2

VirusTotal

65/65 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.