📦

cohesivity

Name: cohesivity
Author: cohesivity-org

v2923f0623a63 Revisión del contenido r1 Riesgo alto ⚙️ Comandos externos🌐 Acceso a red

Provision Backend Infrastructure with Cohesivity

Building an application often requires coordinating many backend providers, credentials, and consoles. This skill provisions Cohesivity services through one guarded workflow and API.

Compatible con: Claude Codex Code(CC)

⚠️ 38 Deficiente

Maintain this Skill? Claim it ⚠️ 38 Deficiente

Detente y solicita confirmación antes de instalar.

Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "cohesivity" from https://skillstore.io/skills/cohesivity-org-cohesivity.md and its manifest at https://skillstore.io/api/skills/cohesivity-org-cohesivity/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/cohesivity-org-cohesivity.md Manifest firmado GET /api/skills/cohesivity-org-cohesivity/manifest Lockfile firmado GET /api/skills/cohesivity-org-cohesivity/lockfile

Pruébalo

Usando "cohesivity". Add a database and login to this notes application using Cohesivity.

Resultado esperado:

Found no existing tenant. Proposed resources: Postgres and social login. Tenant creation and each resource require approval before provisioning.

Usando "cohesivity". Check whether this temporary project is close to its limits.

Resultado esperado:

Tenant lifecycle: ephemeral, with 31 hours remaining.
Postgres usage is within its cap.
Browser minutes are near the shared identity limit.
No paid action was performed.

Usando "cohesivity". Deploy this API and keep it online after the trial ends.

Resultado esperado:

Deployment files are prepared, but claiming creates durable state. Current pricing must be reviewed before requesting claim and deployment approval.

Auditoría de seguridad

Riesgo alto

v1 • 12/9/2026 Abrir el informe versionado

Most external-command alerts are Markdown false positives. Two findings direct a version-pinned npx installer, while network access and local credential reuse are core behavior. Mutable live documentation can change operational instructions after marketplace review, creating a high-confidence remote instruction supply-chain risk.

Archivos escaneados

117

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (4)

Alto

SKILL.md:12-14 SKILL.md:75 SKILL.md:111-116

Mutable Remote Instructions Bypass Audit

The skill treats live web documentation as operational authority and fetches it during use. Those instructions can change after marketplace review and influence privileged actions.

The file explicitly calls live documentation the source of truth and requires fetching it at use time. Multiple workflows depend on those mutable responses.

Bajo

SKILL.md:20

System reconnaissance

1. **Valid `.cohesivity` in the project:** read its credentials and reuse the tenant. Use direct HTT

The skill directs the agent to locate and read a local .cohesivity file containing credentials. This intended access exposes secrets to the agent and remote workflow.

Bajo

SKILL.md:97

System reconnaissance

- Bootstrapping again when a valid `.cohesivity` already exists — read it and reuse it through the d

The instruction requires detecting and reading an existing local .cohesivity credential file. This is narrow project inspection, but it still accesses sensitive configuration.

Bajo

SKILL.md:38 SKILL.md:50 SKILL.md:66

Automatic Client Attribution

The installer sets an attributing User-Agent, and manual requests must use a non-default value. This sends client identity metadata to Cohesivity.

The skill explicitly describes an attributing User-Agent and automatic identification of the calling agent. The exact collected fields are not disclosed.

Elementos de revisión de capacidades (14)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Medio

SKILL.md:23

Ruby/shell backtick execution

4. **No Cohesivity MCP available:** from the project root, run the exact version-pinned installer `n

The skill explicitly directs the agent to run a version-pinned npx installer with automatic confirmation. This executes downloaded package code and changes project state.

Medio

SKILL.md:40-42

Ruby/shell backtick execution

```bash

The fenced shell block contains the npx installer command on line 41. Running it executes third-party package code and can modify local and remote state.

Medio

SKILL.md:32

Hardcoded URL

2. **Data plane** (`https://cohesivity.ai/edge/*`): runtime calls to provisioned services from the t

The data plane sends the application key in URL query parameters. Such credentials can leak through URL logs, request histories, or intermediary telemetry.

Medio

SKILL.md:82

Hardcoded URL

`inbox` exposes one agent-native address with send/receive/list/read/reply/delete; ephemeral tenants

The skill directs deployment file uploads and hosting management through Cohesivity APIs. This intended transfer can disclose project contents to the remote service.

Medio

SKILL.md:89

Hardcoded URL

- **Billing is a consent gate.** Fetch `https://cohesivity.ai/pricing` for current plans and amounts

This line directs remote pricing retrieval and billing calls after approval. Those calls can create financial commitments, and the top-up operation is not idempotent.

Medio

SKILL.md:93

Hardcoded URL

Managed agents (private always-on Hermes agents) are claimed-only, spend from the wallet, and are a

The skill links to remote managed-agent instructions for a service that spends from the wallet. Network-driven provisioning therefore carries financial and persistent-state risk.

Bajo

SKILL.md:66

HTTP client library

- **Send a non-default User-Agent** on every request to `cohesivity.ai`, docs included. The WAF reje

The skill requires manual requests to cohesivity.ai to use a non-default User-Agent. This is intentional outbound communication that may expose client-identifying metadata.

Bajo

SKILL.md:14

Hardcoded URL

This skill does not manage its own installation or updates. Whatever delivered it owns that. The can

The skill advertises a canonical remote skill URL that a deliverer may query for updates. This enables intentional outbound traffic and mutable remote content.

Bajo

SKILL.md:31

Hardcoded URL

1. **Control plane** (`https://cohesivity.ai/api/*`): tenant lifecycle, provisioning, billing, statu

This line defines authenticated control-plane requests to cohesivity.ai. Transmitting the management credential is intended service behavior but remains a network and secret-handling risk.

Bajo

SKILL.md:75

Hardcoded URL

2. **Fetch the resource's live doc, then provision through MCP.** Read `https://cohesivity.ai/offeri

The workflow requires fetching live resource documentation and invoking remote MCP provisioning. These network operations are intentional and can alter infrastructure after authorization.

Bajo

SKILL.md:113

Hardcoded URL

- Per-resource API, quirks, limits: `https://cohesivity.ai/offerings/<name>`

The skill directs the agent to fetch per-resource API instructions from cohesivity.ai. This is explicit network access to mutable operational documentation.

Bajo

SKILL.md:114

Hardcoded URL

- Index of everything: `https://cohesivity.ai/llms.txt` (full reference: `llms-full.txt`)

The listed remote indexes are intended to be fetched for service reference. Their contents can change independently of the audited skill.

Bajo

SKILL.md:115

Hardcoded URL

- Pricing and tier limits: `https://cohesivity.ai/pricing`

The pricing URL is an explicit remote dependency used before paid actions. Fetching it is intended network behavior.

Bajo

SKILL.md:116

Hardcoded URL

- Latest skill: `https://cohesivity.ai/skill.md`

The canonical skill URL is a remote update source. Querying it is intentional network access and can expose unaudited content changes.

Factores de riesgo

⚙️ Comandos externos (48)

🌐 Acceso a red (12)

SKILL.md:66 SKILL.md:14 SKILL.md:31 SKILL.md:32 SKILL.md:75 SKILL.md:82 SKILL.md:89 SKILL.md:93 SKILL.md:113 SKILL.md:114 SKILL.md:115 SKILL.md:116

Patrones detectados

System reconnaissance×2

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/cohesivity-org-cohesivity/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/cohesivity-org-cohesivity/security.svg)](https://skillstore.io/skills/cohesivity-org-cohesivity?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/cohesivity-org-cohesivity?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cohesivity-org-cohesivity/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/cohesivity-org-cohesivity.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

cohesivity-org. (2026). cohesivity security audit report (audit version 1) [Author version 2923f0623a63]. Skillstore. https://skillstore.io/skills/cohesivity-org-cohesivity/audits/1

Cita BibTeX

@techreport{cohesivity-org-cohesivity-org-cohesivity-2026,
  author = {cohesivity-org},
  title = {cohesivity security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/cohesivity-org-cohesivity/audits/1},
  note = {Author version 2923f0623a63}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "cohesivity security audit report (audit version 1)"
version: "2923f0623a63"
type: report
authors:
  - name: "cohesivity-org"
date-released: "2026-09-12"
url: "https://skillstore.io/skills/cohesivity-org-cohesivity/audits/1"
identifiers:
  - type: other
    value: "skillstore:cohesivity-org-cohesivity:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Launch an Application Backend

Provision a database, authentication, storage, and hosting for a new application without managing separate provider consoles.

Add Managed Services

Attach Redis, realtime messaging, email, vector storage, or model APIs to an existing project.

Operate Project Infrastructure

Check tenant status, review quotas, claim temporary projects, and perform approved billing actions.

Prueba estos prompts

Create a Basic Backend

Create a Cohesivity backend for my project with Postgres and authentication. Explain the proposed tenant change and wait for required approval.

Add a Managed Service

Inspect this project for an existing Cohesivity configuration. Add Redis using current service documentation and request approval before provisioning.

Deploy a Server Application

Prepare this server application for Cohesivity hosting. Review deployment files, protect secrets, show expected costs, and request approval before upload.

Design a Multi-Service Architecture

Design a Cohesivity architecture using Postgres, vector storage, inbox, realtime, and an AI gateway. Verify live limits and stage every mutation for approval.

Mejores prácticas

Reuse an existing valid tenant and read credentials only from the protected project configuration.
Fetch current resource documentation, summarize the planned effect, and obtain explicit authorization before every mutation.
Keep all Cohesivity keys server-side and redact them from logs, screenshots, chat, and deployment output.

Evitar

Do not create duplicate tenants when a valid project configuration or MCP tenant already exists.
Do not send direct control-plane mutations that bypass MCP confirmation checks.
Do not retry non-idempotent top-ups or cross billing and durable-state gates without explicit approval.

Preguntas frecuentes

What services can this skill provision?

It covers databases, caching, storage, hosting, authentication, realtime, inbox, browser automation, and selected AI APIs.

Does tenant creation require approval?

Yes. Creating a tenant changes external state, so the current request must explicitly authorize it.

Where are Cohesivity credentials stored?

Local project credentials reside in the .cohesivity file. Remote account credentials remain inside the account MCP.

Can Cohesivity keys be used in browser code?

No. Management and application keys must remain server-side, with a proxy used for browser-only applications.

How long does a new tenant last?

An ephemeral tenant lasts 72 hours and has resource caps. Claiming preserves it after explicit approval.

Does the skill perform paid actions automatically?

No. Billing, upgrades, managed agents, and other paid actions require current pricing disclosure and explicit approval.

Detalles del desarrollador

Autor

cohesivity-org

Licencia

MIT

Versión del autor

v2923f0623a63

Revisión de Skillstore

Aviso de versión

La versión declarada por el autor no es un SemVer válido.

Repositorio

https://github.com/cohesivity-org/cohesivity-plugin/tree/357c8bdaa7d2204e714033f5de42befe1e6dbf48/skills/cohesivity

Ref.

5526951beaeca22519572a471618555839b53b05

Actualidad del mantenimiento

14/9/2026

Uso

0 descargas · 0 vistas

Estructura de archivos

📄 SKILL.md