Security Audit

sheet-cog

github.com/CellCog/cellcog_python

AI SkillCommit b520750df1a6

TRUSTED

Scanned 5 days ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

sheet-cog received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.

SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Unpinned dependency in manifest.

The analysis covered 4 layers: dependency_graph, llm_behavioral_safety, manifest_analysis, static_code_analysis. All layers scored 70 or above, reflecting consistent security practices.

Last analyzed on February 15, 2026 (commit b520750d). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

100%

Static Code Analysis

85%

Dependency Graph

100%

LLM Behavioral Safety

100%

Behavioral Risk Signals

Shell Execution

1 finding

Security Findings1

Severity	Finding	Layer	Location
HIGH	Unpinned dependency in manifest The skill's manifest specifies a dependency on 'cellcog' without a version constraint. This allows `clawhub` to install the latest available version, which could be malicious if the package maintainer's account is compromised or if a typosquatting attack occurs. This introduces a supply chain risk where a compromised dependency could lead to arbitrary code execution. Pin the dependency to a specific version or a version range (e.g., `"cellcog": "==1.2.3"` or `"cellcog": ">=1.0.0,<2.0.0"`) to ensure predictable and secure dependency resolution.	Unknown	Manifest

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/2ec128c346ffe01f.svg)](https://skillshield.io/report/2ec128c346ffe01f)