Skills cocoindex

📦

cocoindex

Name: cocoindex
Author: Joseph OBrien

v1.0.1 Content revision r1 High Risk ⚡ Contains scripts🌐 Network access🔑 Env variables📁 Filesystem access⚙️ External commands

Build CocoIndex Data Pipelines

AI data projects need reliable indexing flows, custom transforms, and operational commands. This skill guides CocoIndex design, implementation, testing, and troubleshooting.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "cocoindex" from https://skillstore.io/skills/89jobrien-cocoindex.md and its manifest at https://skillstore.io/api/skills/89jobrien-cocoindex/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/89jobrien-cocoindex.md Signed manifest GET /api/skills/89jobrien-cocoindex/manifest Signed lockfile GET /api/skills/89jobrien-cocoindex/lockfile

Test it

Using "cocoindex". I need a vector search index for product manuals.

Expected outcome:

A flow plan with source selection, chunking strategy, embedding model choice, target schema, and test steps.

Using "cocoindex". My flow changed and the target schema no longer matches.

Expected outcome:

A troubleshooting checklist that reviews setup state, flow targets, schema changes, and safe validation steps.

Using "cocoindex". I want reusable logic for both indexing and search queries.

Expected outcome:

A transform flow design that reuses embedding logic and explains how query handlers should call it.

Security Audit

High Risk

v7 • 7/5/2026 Open versioned report

Most static findings are Markdown documentation samples or CocoIndex API examples, including false positives for Markdown backticks and transform_flow.eval(). Confirmed risks remain around secret exposure during troubleshooting, instructions to collect API key values in chat, and destructive flow commands that need explicit confirmation. No evidence of prompt injection was found in the reviewed files.

Files scanned

2,833

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

references/cli-operations.md:346

Environment file access

cat .env | grep COCOINDEX_DATABASE_URL

The command displays a sensitive .env entry containing the database connection URL. This can reveal credentials during troubleshooting.

High

SKILL.md:115-117

Credential Collection Instruction

The skill instructs the assistant to ask the user to provide missing API key values and to avoid simplified examples without LLMs. This encourages disclosure of secrets in chat instead of safer environment setup guidance.

The cited lines directly tell the assistant to ask for an API key value when it is missing. That is a clear secret-handling risk in an agent marketplace skill.

Medium

SKILL.md:279-282 SKILL.md:467-482

Destructive Operations Without Strong Confirmation

The skill includes commands that force setup without confirmation and remove or reset CocoIndex resources. These commands should be gated by explicit user confirmation and backup guidance.

The cited examples include a force flag, reset language, and a drop command. They are legitimate CocoIndex operations, but unsafe if an agent runs them without confirmation.

Capability review items (5)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/cli-operations.md:346

Database connection strings

cat .env | grep COCOINDEX_DATABASE_URL

The troubleshooting command reads .env and prints the database URL line, which can expose credentials in terminal output or agent logs.

High

references/cli-operations.md:349

Database connection strings

psql $COCOINDEX_DATABASE_URL

Passing COCOINDEX_DATABASE_URL directly to psql can expand a password-bearing URL into process arguments. That may expose credentials on shared systems or logs.

High

SKILL.md:806-807

Ruby/shell backtick execution

- Test connection: `psql $COCOINDEX_DATABASE_URL`

The inline command runs psql with a potentially secret database URL. The command is operationally useful but can expose credentials if executed by an agent.

High

SKILL.md:806

Database connection strings

- Test connection: `psql $COCOINDEX_DATABASE_URL`

The troubleshooting guidance invokes psql with COCOINDEX_DATABASE_URL, which may include a database password. Shell expansion can expose the secret in process metadata.

Medium

SKILL.md:812-816

Ruby/shell backtick execution

- Drop and recreate: `cocoindex drop main.py && cocoindex setup main.py`

The inline command uses cocoindex drop before setup, which can remove flow resources. It should require explicit confirmation and a backup plan.

Risk Factors

⚡ Contains scripts (5)

references/api-operations.md:271 references/api-operations.md:302 references/api-operations.md:360 references/flow-patterns.md:338 SKILL.md:572

🌐 Network access (16)

references/api-operations.md:348 references/custom-functions.md:427 SKILL.md:36 SKILL.md:37 SKILL.md:99 SKILL.md:133 SKILL.md:244 SKILL.md:286 SKILL.md:366 SKILL.md:447 SKILL.md:499 SKILL.md:577 SKILL.md:685 SKILL.md:686 SKILL.md:840 SKILL.md:841

🔑 Env variables (44)

📁 Filesystem access (2)

references/cli-operations.md:49 references/cli-operations.md:352

⚙️ External commands (120)

SKILL.md:81 SKILL.md:85 SKILL.md:86 SKILL.md:87 SKILL.md:88 SKILL.md:93 SKILL.md:94 SKILL.md:95 SKILL.md:97 SKILL.md:105 SKILL.md:106 SKILL.md:119 SKILL.md:121-131 SKILL.md:131-137 SKILL.md:137-151 SKILL.md:151-157 SKILL.md:157-196 SKILL.md:196-201 SKILL.md:201-202 SKILL.md:202 SKILL.md:211-215 SKILL.md:215-219 SKILL.md:219-223 SKILL.md:223-227 SKILL.md:227-237 SKILL.md:237-250 SKILL.md:250-252 SKILL.md:252-254 SKILL.md:254-256 SKILL.md:256-258 SKILL.md:258-260 SKILL.md:260-262 SKILL.md:262-279 SKILL.md:279-288 SKILL.md:288-303 SKILL.md:303 SKILL.md:310 SKILL.md:313-314 SKILL.md:314-317 SKILL.md:317-318 SKILL.md:318 SKILL.md:321-322 SKILL.md:322-323 SKILL.md:323 SKILL.md:325-327 SKILL.md:327-331 SKILL.md:331-364 SKILL.md:364-388 SKILL.md:388-400 SKILL.md:400-404 SKILL.md:404-406 SKILL.md:406 SKILL.md:410-434 SKILL.md:434-443 SKILL.md:443-445 SKILL.md:445-455 SKILL.md:455-457 SKILL.md:457-461 SKILL.md:461-469 SKILL.md:469-473 SKILL.md:473-477 SKILL.md:477-481 SKILL.md:481-483 SKILL.md:483-487 SKILL.md:487-489 SKILL.md:489-493 SKILL.md:493-495 SKILL.md:495-497 SKILL.md:497-505 SKILL.md:505-516 SKILL.md:516-520 SKILL.md:520-526 SKILL.md:526-530 SKILL.md:530-548 SKILL.md:548-552 SKILL.md:552-557 SKILL.md:557-561 SKILL.md:561-573 SKILL.md:573-575 SKILL.md:575-585 SKILL.md:585-592 SKILL.md:592-596 SKILL.md:596-598 SKILL.md:598-602 SKILL.md:602-606 SKILL.md:606-612 SKILL.md:612-619 SKILL.md:619-625 SKILL.md:625-632 SKILL.md:632-636 SKILL.md:636-641 SKILL.md:641-649 SKILL.md:649-681 SKILL.md:681-692 SKILL.md:692-698 SKILL.md:698-702 SKILL.md:702-709 SKILL.md:709-713 SKILL.md:713-718 SKILL.md:718-724 SKILL.md:724-736 SKILL.md:736-740 SKILL.md:740-746 SKILL.md:746-750 SKILL.md:750-757 SKILL.md:757-761 SKILL.md:761-770 SKILL.md:770-774 SKILL.md:774-793 SKILL.md:793-799 SKILL.md:799-800 SKILL.md:800-805 SKILL.md:805 SKILL.md:806-807 SKILL.md:807-811 SKILL.md:811-812 SKILL.md:812-816 SKILL.md:816-821 SKILL.md:821 SKILL.md:822

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/89jobrien-cocoindex/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/89jobrien-cocoindex/security.svg)](https://skillstore.io/skills/89jobrien-cocoindex?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/89jobrien-cocoindex?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/89jobrien-cocoindex/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/89jobrien-cocoindex.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Joseph OBrien. (2026). cocoindex security audit report (audit version 7) [Author version 1.0.1]. Skillstore. https://skillstore.io/skills/89jobrien-cocoindex/audits/7

BibTeX citation

@techreport{joseph-obrien-89jobrien-cocoindex-2026,
  author = {Joseph OBrien},
  title = {cocoindex security audit report (audit version 7)},
  institution = {Skillstore},
  year = {2026},
  number = {7},
  url = {https://skillstore.io/skills/89jobrien-cocoindex/audits/7},
  note = {Author version 1.0.1}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "cocoindex security audit report (audit version 7)"
version: "1.0.1"
type: report
authors:
  - name: "Joseph OBrien"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/89jobrien-cocoindex/audits/7"
identifiers:
  - type: other
    value: "skillstore:89jobrien-cocoindex:audit:7"
    description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Higher Skillstore usage

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

Joseph OBrien Recommended Current

89jobrien-cocoindex

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 15

Updated

2026-08-21

davila7

davila7-cocoindex

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 6

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create Document Vector Search

Design a flow that chunks documents, creates embeddings, and exports searchable vectors to a target database.

Extract Knowledge Graphs

Build an LLM extraction workflow that identifies entities and relationships from source documents.

Operate Production Flows

Use CocoIndex CLI and API patterns to set up, update, inspect, and troubleshoot indexing workflows.

Try These Prompts

Start a Basic Flow

Create a CocoIndex flow for local Markdown files that chunks text, embeds each chunk, and exports vectors to Postgres.

Add a Custom Transform

Help me add a typed CocoIndex custom function that cleans document text before embedding and explains where caching is useful.

Design LLM Extraction

Design a CocoIndex workflow that extracts entities and relationships from PDFs and exports them as a Neo4j knowledge graph.

Plan Production Operations

Review my CocoIndex flow plan for live updates, query handlers, concurrency limits, setup commands, and safe operational checks.

Best Practices

Confirm data sources, target stores, model providers, and update frequency before designing a flow.
Use typed custom function returns so CocoIndex can infer schemas before processing data.
Test with evaluate or non-production targets before running setup, reset, drop, or live updates.

Avoid

Do not ask users to paste secret values into chat when environment setup is enough.
Do not run reset or drop commands without explicit user confirmation and a backup plan.
Do not use local variables for transformed flow fields that must be collected or exported.