📦

cohesivity

Name: cohesivity
Author: cohesivity-org

v2923f0623a63 Revisão do conteúdo r1 Risco alto ⚙️ Comandos externos🌐 Acesso à rede

Provision Backend Infrastructure with Cohesivity

Building an application often requires coordinating many backend providers, credentials, and consoles. This skill provisions Cohesivity services through one guarded workflow and API.

Suporta: Claude Codex Code(CC)

⚠️ 38 Ruim

Pare e solicite confirmação antes de instalar.

Revise o plano e obtenha o consentimento explícito do usuário antes de alterar arquivos.

Instalar com meu Agente

Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.

Solicitação do agente

Review the Skillstore skill "cohesivity" from https://skillstore.io/skills/cohesivity-org-cohesivity.md and its manifest at https://skillstore.io/api/skills/cohesivity-org-cohesivity/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.

Recursos legíveis por agentes

Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.

Detalhe em Markdown GET /skills/cohesivity-org-cohesivity.md manifest assinado GET /api/skills/cohesivity-org-cohesivity/manifest lockfile assinado GET /api/skills/cohesivity-org-cohesivity/lockfile

Testar

Usando "cohesivity". Add a database and login to this notes application using Cohesivity.

Resultado esperado:

Found no existing tenant. Proposed resources: Postgres and social login. Tenant creation and each resource require approval before provisioning.

Usando "cohesivity". Check whether this temporary project is close to its limits.

Resultado esperado:

Tenant lifecycle: ephemeral, with 31 hours remaining.
Postgres usage is within its cap.
Browser minutes are near the shared identity limit.
No paid action was performed.

Usando "cohesivity". Deploy this API and keep it online after the trial ends.

Resultado esperado:

Deployment files are prepared, but claiming creates durable state. Current pricing must be reviewed before requesting claim and deployment approval.

Auditoria de segurança

Risco alto

v1 • 12/09/2026 Abrir o relatório versionado

Most external-command alerts are Markdown false positives. Two findings direct a version-pinned npx installer, while network access and local credential reuse are core behavior. Mutable live documentation can change operational instructions after marketplace review, creating a high-confidence remote instruction supply-chain risk.

Arquivos analisados

117

Linhas analisadas

Itens de revisão

Falsos positivos ignorados

Preocupações de segurança confirmadas (4)

Alto

SKILL.md:12-14 SKILL.md:75 SKILL.md:111-116

Mutable Remote Instructions Bypass Audit

The skill treats live web documentation as operational authority and fetches it during use. Those instructions can change after marketplace review and influence privileged actions.

The file explicitly calls live documentation the source of truth and requires fetching it at use time. Multiple workflows depend on those mutable responses.

Baixo

SKILL.md:20

System reconnaissance

1. **Valid `.cohesivity` in the project:** read its credentials and reuse the tenant. Use direct HTT

The skill directs the agent to locate and read a local .cohesivity file containing credentials. This intended access exposes secrets to the agent and remote workflow.

Baixo

SKILL.md:97

System reconnaissance

- Bootstrapping again when a valid `.cohesivity` already exists — read it and reuse it through the d

The instruction requires detecting and reading an existing local .cohesivity credential file. This is narrow project inspection, but it still accesses sensitive configuration.

Baixo

SKILL.md:38 SKILL.md:50 SKILL.md:66

Automatic Client Attribution

The installer sets an attributing User-Agent, and manual requests must use a non-default value. This sends client identity metadata to Cohesivity.

The skill explicitly describes an attributing User-Agent and automatic identification of the calling agent. The exact collected fields are not disclosed.

Itens de revisão de capacidade (14)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Médio

SKILL.md:23

Ruby/shell backtick execution

4. **No Cohesivity MCP available:** from the project root, run the exact version-pinned installer `n

The skill explicitly directs the agent to run a version-pinned npx installer with automatic confirmation. This executes downloaded package code and changes project state.

Médio

SKILL.md:40-42

Ruby/shell backtick execution

```bash

The fenced shell block contains the npx installer command on line 41. Running it executes third-party package code and can modify local and remote state.

Médio

SKILL.md:32

Hardcoded URL

2. **Data plane** (`https://cohesivity.ai/edge/*`): runtime calls to provisioned services from the t

The data plane sends the application key in URL query parameters. Such credentials can leak through URL logs, request histories, or intermediary telemetry.

Médio

SKILL.md:82

Hardcoded URL

`inbox` exposes one agent-native address with send/receive/list/read/reply/delete; ephemeral tenants

The skill directs deployment file uploads and hosting management through Cohesivity APIs. This intended transfer can disclose project contents to the remote service.

Médio

SKILL.md:89

Hardcoded URL

- **Billing is a consent gate.** Fetch `https://cohesivity.ai/pricing` for current plans and amounts

This line directs remote pricing retrieval and billing calls after approval. Those calls can create financial commitments, and the top-up operation is not idempotent.

Médio

SKILL.md:93

Hardcoded URL

Managed agents (private always-on Hermes agents) are claimed-only, spend from the wallet, and are a

The skill links to remote managed-agent instructions for a service that spends from the wallet. Network-driven provisioning therefore carries financial and persistent-state risk.

Baixo

SKILL.md:66

HTTP client library

- **Send a non-default User-Agent** on every request to `cohesivity.ai`, docs included. The WAF reje

The skill requires manual requests to cohesivity.ai to use a non-default User-Agent. This is intentional outbound communication that may expose client-identifying metadata.

Baixo

SKILL.md:14

Hardcoded URL

This skill does not manage its own installation or updates. Whatever delivered it owns that. The can

The skill advertises a canonical remote skill URL that a deliverer may query for updates. This enables intentional outbound traffic and mutable remote content.

Baixo

SKILL.md:31

Hardcoded URL

1. **Control plane** (`https://cohesivity.ai/api/*`): tenant lifecycle, provisioning, billing, statu

This line defines authenticated control-plane requests to cohesivity.ai. Transmitting the management credential is intended service behavior but remains a network and secret-handling risk.

Baixo

SKILL.md:75

Hardcoded URL

2. **Fetch the resource's live doc, then provision through MCP.** Read `https://cohesivity.ai/offeri

The workflow requires fetching live resource documentation and invoking remote MCP provisioning. These network operations are intentional and can alter infrastructure after authorization.

Baixo

SKILL.md:113

Hardcoded URL

- Per-resource API, quirks, limits: `https://cohesivity.ai/offerings/<name>`

The skill directs the agent to fetch per-resource API instructions from cohesivity.ai. This is explicit network access to mutable operational documentation.

Baixo

SKILL.md:114

Hardcoded URL

- Index of everything: `https://cohesivity.ai/llms.txt` (full reference: `llms-full.txt`)

The listed remote indexes are intended to be fetched for service reference. Their contents can change independently of the audited skill.

Baixo

SKILL.md:115

Hardcoded URL

- Pricing and tier limits: `https://cohesivity.ai/pricing`

The pricing URL is an explicit remote dependency used before paid actions. Fetching it is intended network behavior.

Baixo

SKILL.md:116

Hardcoded URL

- Latest skill: `https://cohesivity.ai/skill.md`

The canonical skill URL is a remote update source. Querying it is intentional network access and can expose unaudited content changes.

Fatores de risco

⚙️ Comandos externos (48)

🌐 Acesso à rede (12)

SKILL.md:66 SKILL.md:14 SKILL.md:31 SKILL.md:32 SKILL.md:75 SKILL.md:82 SKILL.md:89 SKILL.md:93 SKILL.md:113 SKILL.md:114 SKILL.md:115 SKILL.md:116

Padrões detectados

System reconnaissance×2

Auditado por: codex

Compartilhar e citar este relatório

Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.

Abrir o relatório versionado

Copiar link do relatório

https://skillstore.io/skills/cohesivity-org-cohesivity/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/cohesivity-org-cohesivity/security.svg)](https://skillstore.io/skills/cohesivity-org-cohesivity?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/cohesivity-org-cohesivity?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cohesivity-org-cohesivity/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Cartão incorporável

<iframe src="https://skillstore.io/embed/skills/cohesivity-org-cohesivity.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citações acadêmicas (APA · BibTeX · CFF)

Citação APA

cohesivity-org. (2026). cohesivity security audit report (audit version 1) [Author version 2923f0623a63]. Skillstore. https://skillstore.io/skills/cohesivity-org-cohesivity/audits/1

Citação BibTeX

@techreport{cohesivity-org-cohesivity-org-cohesivity-2026,
  author = {cohesivity-org},
  title = {cohesivity security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/cohesivity-org-cohesivity/audits/1},
  note = {Author version 2923f0623a63}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "cohesivity security audit report (audit version 1)"
version: "2923f0623a63"
type: report
authors:
  - name: "cohesivity-org"
date-released: "2026-09-12"
url: "https://skillstore.io/skills/cohesivity-org-cohesivity/audits/1"
identifiers:
  - type: other
    value: "skillstore:cohesivity-org-cohesivity:audit:1"
    description: "Skillstore immutable audit report identifier"

Pontuação do Skillstore

Por que esta pontuação Confiança das evidências: Médio

Arquitetura

Manutenibilidade

Conteúdo

Comunidade

Conformidade com a especificação

O que você pode criar

Launch an Application Backend

Provision a database, authentication, storage, and hosting for a new application without managing separate provider consoles.

Add Managed Services

Attach Redis, realtime messaging, email, vector storage, or model APIs to an existing project.

Operate Project Infrastructure

Check tenant status, review quotas, claim temporary projects, and perform approved billing actions.

Teste estes prompts

Create a Basic Backend

Create a Cohesivity backend for my project with Postgres and authentication. Explain the proposed tenant change and wait for required approval.

Add a Managed Service

Inspect this project for an existing Cohesivity configuration. Add Redis using current service documentation and request approval before provisioning.

Deploy a Server Application

Prepare this server application for Cohesivity hosting. Review deployment files, protect secrets, show expected costs, and request approval before upload.

Design a Multi-Service Architecture

Design a Cohesivity architecture using Postgres, vector storage, inbox, realtime, and an AI gateway. Verify live limits and stage every mutation for approval.

Boas práticas

Reuse an existing valid tenant and read credentials only from the protected project configuration.
Fetch current resource documentation, summarize the planned effect, and obtain explicit authorization before every mutation.
Keep all Cohesivity keys server-side and redact them from logs, screenshots, chat, and deployment output.

Evitar

Do not create duplicate tenants when a valid project configuration or MCP tenant already exists.
Do not send direct control-plane mutations that bypass MCP confirmation checks.
Do not retry non-idempotent top-ups or cross billing and durable-state gates without explicit approval.

Perguntas frequentes

What services can this skill provision?

It covers databases, caching, storage, hosting, authentication, realtime, inbox, browser automation, and selected AI APIs.

Does tenant creation require approval?

Yes. Creating a tenant changes external state, so the current request must explicitly authorize it.

Where are Cohesivity credentials stored?

Local project credentials reside in the .cohesivity file. Remote account credentials remain inside the account MCP.

Can Cohesivity keys be used in browser code?

No. Management and application keys must remain server-side, with a proxy used for browser-only applications.

How long does a new tenant last?

An ephemeral tenant lasts 72 hours and has resource caps. Claiming preserves it after explicit approval.

Does the skill perform paid actions automatically?

No. Billing, upgrades, managed agents, and other paid actions require current pricing disclosure and explicit approval.

Detalhes do desenvolvedor

Autor

cohesivity-org

Licença

MIT

Versão do autor

v2923f0623a63

Revisão da Skillstore

Aviso de versão

A versão declarada pelo autor não é um SemVer válido.

Repositório

https://github.com/cohesivity-org/cohesivity-plugin/tree/357c8bdaa7d2204e714033f5de42befe1e6dbf48/skills/cohesivity

Referência

5526951beaeca22519572a471618555839b53b05

Atualidade da manutenção

14/09/2026

Uso

0 downloads · 0 visualizações

Estrutura de arquivos

📄 SKILL.md