스킬 cohesivity

📦

cohesivity

Name: cohesivity
Author: cohesivity-org

v2923f0623a63 콘텐츠 리비전 r1 높은 위험 ⚙️ 외부 명령어🌐 네트워크 접근

Provision Backend Infrastructure with Cohesivity

Building an application often requires coordinating many backend providers, credentials, and consoles. This skill provisions Cohesivity services through one guarded workflow and API.

지원: Claude Codex Code(CC)

⚠️ 38 나쁨

Maintain this Skill? Claim it ⚠️ 38 나쁨

설치 전에 중지하고 확인을 요청하세요.

계획을 검토하고 파일을 변경하기 전에 사용자의 명시적 동의를 받으세요.

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "cohesivity" from https://skillstore.io/skills/cohesivity-org-cohesivity.md and its manifest at https://skillstore.io/api/skills/cohesivity-org-cohesivity/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/cohesivity-org-cohesivity.md 서명된 manifest GET /api/skills/cohesivity-org-cohesivity/manifest 서명된 lockfile GET /api/skills/cohesivity-org-cohesivity/lockfile

테스트해 보기

"cohesivity" 사용 중입니다. Add a database and login to this notes application using Cohesivity.

예상 결과:

Found no existing tenant. Proposed resources: Postgres and social login. Tenant creation and each resource require approval before provisioning.

"cohesivity" 사용 중입니다. Check whether this temporary project is close to its limits.

예상 결과:

Tenant lifecycle: ephemeral, with 31 hours remaining.
Postgres usage is within its cap.
Browser minutes are near the shared identity limit.
No paid action was performed.

"cohesivity" 사용 중입니다. Deploy this API and keep it online after the trial ends.

예상 결과:

Deployment files are prepared, but claiming creates durable state. Current pricing must be reviewed before requesting claim and deployment approval.

보안 감사

높은 위험

v1 • 2026. 9. 12. 버전별 보고서 열기

Most external-command alerts are Markdown false positives. Two findings direct a version-pinned npx installer, while network access and local credential reuse are core behavior. Mutable live documentation can change operational instructions after marketplace review, creating a high-confidence remote instruction supply-chain risk.

스캔된 파일

117

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (4)

높음

SKILL.md:12-14 SKILL.md:75 SKILL.md:111-116

Mutable Remote Instructions Bypass Audit

The skill treats live web documentation as operational authority and fetches it during use. Those instructions can change after marketplace review and influence privileged actions.

The file explicitly calls live documentation the source of truth and requires fetching it at use time. Multiple workflows depend on those mutable responses.

낮음

SKILL.md:20

System reconnaissance

1. **Valid `.cohesivity` in the project:** read its credentials and reuse the tenant. Use direct HTT

The skill directs the agent to locate and read a local .cohesivity file containing credentials. This intended access exposes secrets to the agent and remote workflow.

낮음

SKILL.md:97

System reconnaissance

- Bootstrapping again when a valid `.cohesivity` already exists — read it and reuse it through the d

The instruction requires detecting and reading an existing local .cohesivity credential file. This is narrow project inspection, but it still accesses sensitive configuration.

낮음

SKILL.md:38 SKILL.md:50 SKILL.md:66

Automatic Client Attribution

The installer sets an attributing User-Agent, and manual requests must use a non-default value. This sends client identity metadata to Cohesivity.

The skill explicitly describes an attributing User-Agent and automatic identification of the calling agent. The exact collected fields are not disclosed.

기능 검토 항목 (14)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

중간

SKILL.md:23

Ruby/shell backtick execution

4. **No Cohesivity MCP available:** from the project root, run the exact version-pinned installer `n

The skill explicitly directs the agent to run a version-pinned npx installer with automatic confirmation. This executes downloaded package code and changes project state.

중간

SKILL.md:40-42

Ruby/shell backtick execution

```bash

The fenced shell block contains the npx installer command on line 41. Running it executes third-party package code and can modify local and remote state.

중간

SKILL.md:32

Hardcoded URL

2. **Data plane** (`https://cohesivity.ai/edge/*`): runtime calls to provisioned services from the t

The data plane sends the application key in URL query parameters. Such credentials can leak through URL logs, request histories, or intermediary telemetry.

중간

SKILL.md:82

Hardcoded URL

`inbox` exposes one agent-native address with send/receive/list/read/reply/delete; ephemeral tenants

The skill directs deployment file uploads and hosting management through Cohesivity APIs. This intended transfer can disclose project contents to the remote service.

중간

SKILL.md:89

Hardcoded URL

- **Billing is a consent gate.** Fetch `https://cohesivity.ai/pricing` for current plans and amounts

This line directs remote pricing retrieval and billing calls after approval. Those calls can create financial commitments, and the top-up operation is not idempotent.

중간

SKILL.md:93

Hardcoded URL

Managed agents (private always-on Hermes agents) are claimed-only, spend from the wallet, and are a

The skill links to remote managed-agent instructions for a service that spends from the wallet. Network-driven provisioning therefore carries financial and persistent-state risk.

낮음

SKILL.md:66

HTTP client library

- **Send a non-default User-Agent** on every request to `cohesivity.ai`, docs included. The WAF reje

The skill requires manual requests to cohesivity.ai to use a non-default User-Agent. This is intentional outbound communication that may expose client-identifying metadata.

낮음

SKILL.md:14

Hardcoded URL

This skill does not manage its own installation or updates. Whatever delivered it owns that. The can

The skill advertises a canonical remote skill URL that a deliverer may query for updates. This enables intentional outbound traffic and mutable remote content.

낮음

SKILL.md:31

Hardcoded URL

1. **Control plane** (`https://cohesivity.ai/api/*`): tenant lifecycle, provisioning, billing, statu

This line defines authenticated control-plane requests to cohesivity.ai. Transmitting the management credential is intended service behavior but remains a network and secret-handling risk.

낮음

SKILL.md:75

Hardcoded URL

2. **Fetch the resource's live doc, then provision through MCP.** Read `https://cohesivity.ai/offeri

The workflow requires fetching live resource documentation and invoking remote MCP provisioning. These network operations are intentional and can alter infrastructure after authorization.

낮음

SKILL.md:113

Hardcoded URL

- Per-resource API, quirks, limits: `https://cohesivity.ai/offerings/<name>`

The skill directs the agent to fetch per-resource API instructions from cohesivity.ai. This is explicit network access to mutable operational documentation.

낮음

SKILL.md:114

Hardcoded URL

- Index of everything: `https://cohesivity.ai/llms.txt` (full reference: `llms-full.txt`)

The listed remote indexes are intended to be fetched for service reference. Their contents can change independently of the audited skill.

낮음

SKILL.md:115

Hardcoded URL

- Pricing and tier limits: `https://cohesivity.ai/pricing`

The pricing URL is an explicit remote dependency used before paid actions. Fetching it is intended network behavior.

낮음

SKILL.md:116

Hardcoded URL

- Latest skill: `https://cohesivity.ai/skill.md`

The canonical skill URL is a remote update source. Querying it is intentional network access and can expose unaudited content changes.

위험 요인

⚙️ 외부 명령어 (48)

🌐 네트워크 접근 (12)

SKILL.md:66 SKILL.md:14 SKILL.md:31 SKILL.md:32 SKILL.md:75 SKILL.md:82 SKILL.md:89 SKILL.md:93 SKILL.md:113 SKILL.md:114 SKILL.md:115 SKILL.md:116

감지된 패턴

System reconnaissance×2

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/cohesivity-org-cohesivity/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/cohesivity-org-cohesivity/security.svg)](https://skillstore.io/skills/cohesivity-org-cohesivity?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/cohesivity-org-cohesivity?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cohesivity-org-cohesivity/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/cohesivity-org-cohesivity.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

cohesivity-org. (2026). cohesivity security audit report (audit version 1) [Author version 2923f0623a63]. Skillstore. https://skillstore.io/skills/cohesivity-org-cohesivity/audits/1

BibTeX 인용

@techreport{cohesivity-org-cohesivity-org-cohesivity-2026,
  author = {cohesivity-org},
  title = {cohesivity security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/cohesivity-org-cohesivity/audits/1},
  note = {Author version 2923f0623a63}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "cohesivity security audit report (audit version 1)"
version: "2923f0623a63"
type: report
authors:
  - name: "cohesivity-org"
date-released: "2026-09-12"
url: "https://skillstore.io/skills/cohesivity-org-cohesivity/audits/1"
identifiers:
  - type: other
    value: "skillstore:cohesivity-org-cohesivity:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Launch an Application Backend

Provision a database, authentication, storage, and hosting for a new application without managing separate provider consoles.

Add Managed Services

Attach Redis, realtime messaging, email, vector storage, or model APIs to an existing project.

Operate Project Infrastructure

Check tenant status, review quotas, claim temporary projects, and perform approved billing actions.

이 프롬프트를 사용해 보세요

Create a Basic Backend

Create a Cohesivity backend for my project with Postgres and authentication. Explain the proposed tenant change and wait for required approval.

Add a Managed Service

Inspect this project for an existing Cohesivity configuration. Add Redis using current service documentation and request approval before provisioning.

Deploy a Server Application

Prepare this server application for Cohesivity hosting. Review deployment files, protect secrets, show expected costs, and request approval before upload.

Design a Multi-Service Architecture

Design a Cohesivity architecture using Postgres, vector storage, inbox, realtime, and an AI gateway. Verify live limits and stage every mutation for approval.

모범 사례

Reuse an existing valid tenant and read credentials only from the protected project configuration.
Fetch current resource documentation, summarize the planned effect, and obtain explicit authorization before every mutation.
Keep all Cohesivity keys server-side and redact them from logs, screenshots, chat, and deployment output.

피하기

Do not create duplicate tenants when a valid project configuration or MCP tenant already exists.
Do not send direct control-plane mutations that bypass MCP confirmation checks.
Do not retry non-idempotent top-ups or cross billing and durable-state gates without explicit approval.

자주 묻는 질문

What services can this skill provision?

It covers databases, caching, storage, hosting, authentication, realtime, inbox, browser automation, and selected AI APIs.

Does tenant creation require approval?

Yes. Creating a tenant changes external state, so the current request must explicitly authorize it.

Where are Cohesivity credentials stored?

Local project credentials reside in the .cohesivity file. Remote account credentials remain inside the account MCP.

Can Cohesivity keys be used in browser code?

No. Management and application keys must remain server-side, with a proxy used for browser-only applications.

How long does a new tenant last?

An ephemeral tenant lasts 72 hours and has resource caps. Claiming preserves it after explicit approval.

Does the skill perform paid actions automatically?

No. Billing, upgrades, managed agents, and other paid actions require current pricing disclosure and explicit approval.

개발자 세부 정보

작성자

cohesivity-org

라이선스

MIT

작성자 버전

v2923f0623a63

Skillstore 리비전

버전 안내

작성자가 선언한 버전은 유효한 SemVer가 아닙니다.

리포지토리

https://github.com/cohesivity-org/cohesivity-plugin/tree/357c8bdaa7d2204e714033f5de42befe1e6dbf48/skills/cohesivity

참조

5526951beaeca22519572a471618555839b53b05

유지보수 최신성

2026. 9. 14.

사용량

0 다운로드 · 0 조회

파일 구조

📄 SKILL.md