📦

cohesivity

Name: cohesivity
Author: cohesivity-org

v2923f0623a63 Révision du contenu r1 Risque élevé ⚙️ Commandes externes🌐 Accès réseau

Provision Backend Infrastructure with Cohesivity

Building an application often requires coordinating many backend providers, credentials, and consoles. This skill provisions Cohesivity services through one guarded workflow and API.

Prend en charge: Claude Codex Code(CC)

⚠️ 38 Médiocre

Maintain this Skill? Claim it ⚠️ 38 Médiocre

Arrêtez-vous et demandez confirmation avant l’installation.

Examinez le plan et obtenez le consentement explicite de l’utilisateur avant de modifier des fichiers.

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "cohesivity" from https://skillstore.io/skills/cohesivity-org-cohesivity.md and its manifest at https://skillstore.io/api/skills/cohesivity-org-cohesivity/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/cohesivity-org-cohesivity.md manifest signé GET /api/skills/cohesivity-org-cohesivity/manifest lockfile signé GET /api/skills/cohesivity-org-cohesivity/lockfile

Tester

Utilisation de « cohesivity ». Add a database and login to this notes application using Cohesivity.

Résultat attendu:

Found no existing tenant. Proposed resources: Postgres and social login. Tenant creation and each resource require approval before provisioning.

Utilisation de « cohesivity ». Check whether this temporary project is close to its limits.

Résultat attendu:

Tenant lifecycle: ephemeral, with 31 hours remaining.
Postgres usage is within its cap.
Browser minutes are near the shared identity limit.
No paid action was performed.

Utilisation de « cohesivity ». Deploy this API and keep it online after the trial ends.

Résultat attendu:

Deployment files are prepared, but claiming creates durable state. Current pricing must be reviewed before requesting claim and deployment approval.

Audit de sécurité

Risque élevé

v1 • 12/09/2026 Ouvrir le rapport versionné

Most external-command alerts are Markdown false positives. Two findings direct a version-pinned npx installer, while network access and local credential reuse are core behavior. Mutable live documentation can change operational instructions after marketplace review, creating a high-confidence remote instruction supply-chain risk.

Fichiers analysés

117

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (4)

Élevé

SKILL.md:12-14 SKILL.md:75 SKILL.md:111-116

Mutable Remote Instructions Bypass Audit

The skill treats live web documentation as operational authority and fetches it during use. Those instructions can change after marketplace review and influence privileged actions.

The file explicitly calls live documentation the source of truth and requires fetching it at use time. Multiple workflows depend on those mutable responses.

Faible

SKILL.md:20

System reconnaissance

1. **Valid `.cohesivity` in the project:** read its credentials and reuse the tenant. Use direct HTT

The skill directs the agent to locate and read a local .cohesivity file containing credentials. This intended access exposes secrets to the agent and remote workflow.

Faible

SKILL.md:97

System reconnaissance

- Bootstrapping again when a valid `.cohesivity` already exists — read it and reuse it through the d

The instruction requires detecting and reading an existing local .cohesivity credential file. This is narrow project inspection, but it still accesses sensitive configuration.

Faible

SKILL.md:38 SKILL.md:50 SKILL.md:66

Automatic Client Attribution

The installer sets an attributing User-Agent, and manual requests must use a non-default value. This sends client identity metadata to Cohesivity.

The skill explicitly describes an attributing User-Agent and automatic identification of the calling agent. The exact collected fields are not disclosed.

Éléments d’évaluation des capacités (14)

Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.

Moyen

SKILL.md:23

Ruby/shell backtick execution

4. **No Cohesivity MCP available:** from the project root, run the exact version-pinned installer `n

The skill explicitly directs the agent to run a version-pinned npx installer with automatic confirmation. This executes downloaded package code and changes project state.

Moyen

SKILL.md:40-42

Ruby/shell backtick execution

```bash

The fenced shell block contains the npx installer command on line 41. Running it executes third-party package code and can modify local and remote state.

Moyen

SKILL.md:32

Hardcoded URL

2. **Data plane** (`https://cohesivity.ai/edge/*`): runtime calls to provisioned services from the t

The data plane sends the application key in URL query parameters. Such credentials can leak through URL logs, request histories, or intermediary telemetry.

Moyen

SKILL.md:82

Hardcoded URL

`inbox` exposes one agent-native address with send/receive/list/read/reply/delete; ephemeral tenants

The skill directs deployment file uploads and hosting management through Cohesivity APIs. This intended transfer can disclose project contents to the remote service.

Moyen

SKILL.md:89

Hardcoded URL

- **Billing is a consent gate.** Fetch `https://cohesivity.ai/pricing` for current plans and amounts

This line directs remote pricing retrieval and billing calls after approval. Those calls can create financial commitments, and the top-up operation is not idempotent.

Moyen

SKILL.md:93

Hardcoded URL

Managed agents (private always-on Hermes agents) are claimed-only, spend from the wallet, and are a

The skill links to remote managed-agent instructions for a service that spends from the wallet. Network-driven provisioning therefore carries financial and persistent-state risk.

Faible

SKILL.md:66

HTTP client library

- **Send a non-default User-Agent** on every request to `cohesivity.ai`, docs included. The WAF reje

The skill requires manual requests to cohesivity.ai to use a non-default User-Agent. This is intentional outbound communication that may expose client-identifying metadata.

Faible

SKILL.md:14

Hardcoded URL

This skill does not manage its own installation or updates. Whatever delivered it owns that. The can

The skill advertises a canonical remote skill URL that a deliverer may query for updates. This enables intentional outbound traffic and mutable remote content.

Faible

SKILL.md:31

Hardcoded URL

1. **Control plane** (`https://cohesivity.ai/api/*`): tenant lifecycle, provisioning, billing, statu

This line defines authenticated control-plane requests to cohesivity.ai. Transmitting the management credential is intended service behavior but remains a network and secret-handling risk.

Faible

SKILL.md:75

Hardcoded URL

2. **Fetch the resource's live doc, then provision through MCP.** Read `https://cohesivity.ai/offeri

The workflow requires fetching live resource documentation and invoking remote MCP provisioning. These network operations are intentional and can alter infrastructure after authorization.

Faible

SKILL.md:113

Hardcoded URL

- Per-resource API, quirks, limits: `https://cohesivity.ai/offerings/<name>`

The skill directs the agent to fetch per-resource API instructions from cohesivity.ai. This is explicit network access to mutable operational documentation.

Faible

SKILL.md:114

Hardcoded URL

- Index of everything: `https://cohesivity.ai/llms.txt` (full reference: `llms-full.txt`)

The listed remote indexes are intended to be fetched for service reference. Their contents can change independently of the audited skill.

Faible

SKILL.md:115

Hardcoded URL

- Pricing and tier limits: `https://cohesivity.ai/pricing`

The pricing URL is an explicit remote dependency used before paid actions. Fetching it is intended network behavior.

Faible

SKILL.md:116

Hardcoded URL

- Latest skill: `https://cohesivity.ai/skill.md`

The canonical skill URL is a remote update source. Querying it is intentional network access and can expose unaudited content changes.

Facteurs de risque

⚙️ Commandes externes (48)

🌐 Accès réseau (12)

SKILL.md:66 SKILL.md:14 SKILL.md:31 SKILL.md:32 SKILL.md:75 SKILL.md:82 SKILL.md:89 SKILL.md:93 SKILL.md:113 SKILL.md:114 SKILL.md:115 SKILL.md:116

Motifs détectés

System reconnaissance×2

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/cohesivity-org-cohesivity/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/cohesivity-org-cohesivity/security.svg)](https://skillstore.io/skills/cohesivity-org-cohesivity?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/cohesivity-org-cohesivity?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cohesivity-org-cohesivity/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/cohesivity-org-cohesivity.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

cohesivity-org. (2026). cohesivity security audit report (audit version 1) [Author version 2923f0623a63]. Skillstore. https://skillstore.io/skills/cohesivity-org-cohesivity/audits/1

Citation BibTeX

@techreport{cohesivity-org-cohesivity-org-cohesivity-2026,
  author = {cohesivity-org},
  title = {cohesivity security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/cohesivity-org-cohesivity/audits/1},
  note = {Author version 2923f0623a63}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "cohesivity security audit report (audit version 1)"
version: "2923f0623a63"
type: report
authors:
  - name: "cohesivity-org"
date-released: "2026-09-12"
url: "https://skillstore.io/skills/cohesivity-org-cohesivity/audits/1"
identifiers:
  - type: other
    value: "skillstore:cohesivity-org-cohesivity:audit:1"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Launch an Application Backend

Provision a database, authentication, storage, and hosting for a new application without managing separate provider consoles.

Add Managed Services

Attach Redis, realtime messaging, email, vector storage, or model APIs to an existing project.

Operate Project Infrastructure

Check tenant status, review quotas, claim temporary projects, and perform approved billing actions.

Essayez ces prompts

Create a Basic Backend

Create a Cohesivity backend for my project with Postgres and authentication. Explain the proposed tenant change and wait for required approval.

Add a Managed Service

Inspect this project for an existing Cohesivity configuration. Add Redis using current service documentation and request approval before provisioning.

Deploy a Server Application

Prepare this server application for Cohesivity hosting. Review deployment files, protect secrets, show expected costs, and request approval before upload.

Design a Multi-Service Architecture

Design a Cohesivity architecture using Postgres, vector storage, inbox, realtime, and an AI gateway. Verify live limits and stage every mutation for approval.

Bonnes pratiques

Reuse an existing valid tenant and read credentials only from the protected project configuration.
Fetch current resource documentation, summarize the planned effect, and obtain explicit authorization before every mutation.
Keep all Cohesivity keys server-side and redact them from logs, screenshots, chat, and deployment output.

Éviter

Do not create duplicate tenants when a valid project configuration or MCP tenant already exists.
Do not send direct control-plane mutations that bypass MCP confirmation checks.
Do not retry non-idempotent top-ups or cross billing and durable-state gates without explicit approval.

Foire aux questions

What services can this skill provision?

It covers databases, caching, storage, hosting, authentication, realtime, inbox, browser automation, and selected AI APIs.

Does tenant creation require approval?

Yes. Creating a tenant changes external state, so the current request must explicitly authorize it.

Where are Cohesivity credentials stored?

Local project credentials reside in the .cohesivity file. Remote account credentials remain inside the account MCP.

Can Cohesivity keys be used in browser code?

No. Management and application keys must remain server-side, with a proxy used for browser-only applications.

How long does a new tenant last?

An ephemeral tenant lasts 72 hours and has resource caps. Claiming preserves it after explicit approval.

Does the skill perform paid actions automatically?

No. Billing, upgrades, managed agents, and other paid actions require current pricing disclosure and explicit approval.

Détails du développeur

Auteur

cohesivity-org

Licence

MIT

Version de l’auteur

v2923f0623a63

Révision Skillstore

Avis de version

La version déclarée par l’auteur n’est pas un SemVer valide.

Dépôt

https://github.com/cohesivity-org/cohesivity-plugin/tree/357c8bdaa7d2204e714033f5de42befe1e6dbf48/skills/cohesivity

Réf

5526951beaeca22519572a471618555839b53b05

Récence de maintenance

14/09/2026

Utilisation

0 téléchargements · 0 vues

Structure de fichiers

📄 SKILL.md