📦
Historial de auditorías
cohesivity - 1 auditoría
Versión de auditoría 1 Más reciente
12 sept 2026, 00:41
Most external-command alerts are Markdown false positives. Two findings direct a version-pinned npx installer, while network access and local credential reuse are core behavior. Mutable live documentation can change operational instructions after marketplace review, creating a high-confidence remote instruction supply-chain risk.
1
Archivos escaneados
117
Líneas analizadas
20
Elementos de revisión
0
Falsos positivos ignorados
Preocupaciones de seguridad confirmadas (4)
Alto
Mutable Remote Instructions Bypass Audit
The skill treats live web documentation as operational authority and fetches it during use. Those instructions can change after marketplace review and influence privileged actions.
The file explicitly calls live documentation the source of truth and requires fetching it at use time. Multiple workflows depend on those mutable responses.
Bajo
System reconnaissance
1. **Valid `.cohesivity` in the project:** read its credentials and reuse the tenant. Use direct HTT
The skill directs the agent to locate and read a local .cohesivity file containing credentials. This intended access exposes secrets to the agent and remote workflow.
Bajo
System reconnaissance
- Bootstrapping again when a valid `.cohesivity` already exists — read it and reuse it through the d
The instruction requires detecting and reading an existing local .cohesivity credential file. This is narrow project inspection, but it still accesses sensitive configuration.
Bajo
Automatic Client Attribution
The installer sets an attributing User-Agent, and manual requests must use a non-default value. This sends client identity metadata to Cohesivity.
The skill explicitly describes an attributing User-Agent and automatic identification of the calling agent. The exact collected fields are not disclosed.
Elementos de revisión de capacidades (14)
Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.
Medio
Ruby/shell backtick execution
4. **No Cohesivity MCP available:** from the project root, run the exact version-pinned installer `n
The skill explicitly directs the agent to run a version-pinned npx installer with automatic confirmation. This executes downloaded package code and changes project state.
Medio
Ruby/shell backtick execution
```bash
The fenced shell block contains the npx installer command on line 41. Running it executes third-party package code and can modify local and remote state.
Medio
Hardcoded URL
2. **Data plane** (`https://cohesivity.ai/edge/*`): runtime calls to provisioned services from the t
The data plane sends the application key in URL query parameters. Such credentials can leak through URL logs, request histories, or intermediary telemetry.
Medio
Hardcoded URL
`inbox` exposes one agent-native address with send/receive/list/read/reply/delete; ephemeral tenants
The skill directs deployment file uploads and hosting management through Cohesivity APIs. This intended transfer can disclose project contents to the remote service.
Medio
Hardcoded URL
- **Billing is a consent gate.** Fetch `https://cohesivity.ai/pricing` for current plans and amounts
This line directs remote pricing retrieval and billing calls after approval. Those calls can create financial commitments, and the top-up operation is not idempotent.
Medio
Hardcoded URL
Managed agents (private always-on Hermes agents) are claimed-only, spend from the wallet, and are a
The skill links to remote managed-agent instructions for a service that spends from the wallet. Network-driven provisioning therefore carries financial and persistent-state risk.
Bajo
HTTP client library
- **Send a non-default User-Agent** on every request to `cohesivity.ai`, docs included. The WAF reje
The skill requires manual requests to cohesivity.ai to use a non-default User-Agent. This is intentional outbound communication that may expose client-identifying metadata.
Bajo
Hardcoded URL
This skill does not manage its own installation or updates. Whatever delivered it owns that. The can
The skill advertises a canonical remote skill URL that a deliverer may query for updates. This enables intentional outbound traffic and mutable remote content.
Bajo
Hardcoded URL
1. **Control plane** (`https://cohesivity.ai/api/*`): tenant lifecycle, provisioning, billing, statu
This line defines authenticated control-plane requests to cohesivity.ai. Transmitting the management credential is intended service behavior but remains a network and secret-handling risk.
Bajo
Hardcoded URL
2. **Fetch the resource's live doc, then provision through MCP.** Read `https://cohesivity.ai/offeri
The workflow requires fetching live resource documentation and invoking remote MCP provisioning. These network operations are intentional and can alter infrastructure after authorization.
Bajo
Hardcoded URL
- Per-resource API, quirks, limits: `https://cohesivity.ai/offerings/<name>`
The skill directs the agent to fetch per-resource API instructions from cohesivity.ai. This is explicit network access to mutable operational documentation.
Bajo
Hardcoded URL
- Index of everything: `https://cohesivity.ai/llms.txt` (full reference: `llms-full.txt`)
The listed remote indexes are intended to be fetched for service reference. Their contents can change independently of the audited skill.
Bajo
Hardcoded URL
- Pricing and tier limits: `https://cohesivity.ai/pricing`
The pricing URL is an explicit remote dependency used before paid actions. Fetching it is intended network behavior.
Bajo
Hardcoded URL
- Latest skill: `https://cohesivity.ai/skill.md`
The canonical skill URL is a remote update source. Querying it is intentional network access and can expose unaudited content changes.
Factores de riesgo
⚙️ Comandos externos (48)
SKILL.md:3 SKILL.md:14 SKILL.md:20 SKILL.md:21 SKILL.md:22 SKILL.md:23 SKILL.md:25 SKILL.md:31 SKILL.md:32 SKILL.md:38 SKILL.md:40-42 SKILL.md:42-44 SKILL.md:44-46 SKILL.md:46-48 SKILL.md:48-50 SKILL.md:50-52 SKILL.md:52-54 SKILL.md:54-61 SKILL.md:61-65 SKILL.md:65 SKILL.md:66 SKILL.md:67 SKILL.md:68-69 SKILL.md:69-70 SKILL.md:70 SKILL.md:75 SKILL.md:76-78 SKILL.md:78 SKILL.md:80 SKILL.md:82 SKILL.md:86-87 SKILL.md:87 SKILL.md:88-89 SKILL.md:89 SKILL.md:90 SKILL.md:91 SKILL.md:93-97 SKILL.md:97-98 SKILL.md:98-99 SKILL.md:99-101 SKILL.md:101-102 SKILL.md:102-103 SKILL.md:103-105 SKILL.md:105-107 SKILL.md:107-113 SKILL.md:113-114 SKILL.md:114 SKILL.md:115-116
Patrones detectados
System reconnaissanceSystem reconnaissance
Auditado por: codex