技能 cohesivity

📦

cohesivity

Name: cohesivity
Author: cohesivity-org

v2923f0623a63 內容修訂 r1 高風險 ⚙️ 外部命令🌐 網路存取

Provision Backend Infrastructure with Cohesivity

Building an application often requires coordinating many backend providers, credentials, and consoles. This skill provisions Cohesivity services through one guarded workflow and API.

支援: Claude Codex Code(CC)

⚠️ 38 差

Maintain this Skill? Claim it ⚠️ 38 差

安裝前請停止並請求確認。

請審查安裝計畫，並在變更檔案前取得使用者明確同意。

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "cohesivity" from https://skillstore.io/skills/cohesivity-org-cohesivity.md and its manifest at https://skillstore.io/api/skills/cohesivity-org-cohesivity/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/cohesivity-org-cohesivity.md 已簽名 manifest GET /api/skills/cohesivity-org-cohesivity/manifest 已簽名 lockfile GET /api/skills/cohesivity-org-cohesivity/lockfile

測試它

正在使用「cohesivity」。 Add a database and login to this notes application using Cohesivity.

預期結果:

Found no existing tenant. Proposed resources: Postgres and social login. Tenant creation and each resource require approval before provisioning.

正在使用「cohesivity」。 Check whether this temporary project is close to its limits.

預期結果:

Tenant lifecycle: ephemeral, with 31 hours remaining.
Postgres usage is within its cap.
Browser minutes are near the shared identity limit.
No paid action was performed.

正在使用「cohesivity」。 Deploy this API and keep it online after the trial ends.

預期結果:

Deployment files are prepared, but claiming creates durable state. Current pricing must be reviewed before requesting claim and deployment approval.

安全審計

高風險

v1 • 2026/9/12 開啟版本化報告

Most external-command alerts are Markdown false positives. Two findings direct a version-pinned npx installer, while network access and local credential reuse are core behavior. Mutable live documentation can change operational instructions after marketplace review, creating a high-confidence remote instruction supply-chain risk.

已掃描檔案

117

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (4)

高

SKILL.md:12-14 SKILL.md:75 SKILL.md:111-116

Mutable Remote Instructions Bypass Audit

The skill treats live web documentation as operational authority and fetches it during use. Those instructions can change after marketplace review and influence privileged actions.

The file explicitly calls live documentation the source of truth and requires fetching it at use time. Multiple workflows depend on those mutable responses.

低

SKILL.md:20

System reconnaissance

1. **Valid `.cohesivity` in the project:** read its credentials and reuse the tenant. Use direct HTT

The skill directs the agent to locate and read a local .cohesivity file containing credentials. This intended access exposes secrets to the agent and remote workflow.

低

SKILL.md:97

System reconnaissance

- Bootstrapping again when a valid `.cohesivity` already exists — read it and reuse it through the d

The instruction requires detecting and reading an existing local .cohesivity credential file. This is narrow project inspection, but it still accesses sensitive configuration.

低

SKILL.md:38 SKILL.md:50 SKILL.md:66

Automatic Client Attribution

The installer sets an attributing User-Agent, and manual requests must use a non-default value. This sends client identity metadata to Cohesivity.

The skill explicitly describes an attributing User-Agent and automatic identification of the calling agent. The exact collected fields are not disclosed.

能力複核項目 (14)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

中

SKILL.md:23

Ruby/shell backtick execution

4. **No Cohesivity MCP available:** from the project root, run the exact version-pinned installer `n

The skill explicitly directs the agent to run a version-pinned npx installer with automatic confirmation. This executes downloaded package code and changes project state.

中

SKILL.md:40-42

Ruby/shell backtick execution

```bash

The fenced shell block contains the npx installer command on line 41. Running it executes third-party package code and can modify local and remote state.

中

SKILL.md:32

Hardcoded URL

2. **Data plane** (`https://cohesivity.ai/edge/*`): runtime calls to provisioned services from the t

The data plane sends the application key in URL query parameters. Such credentials can leak through URL logs, request histories, or intermediary telemetry.

中

SKILL.md:82

Hardcoded URL

`inbox` exposes one agent-native address with send/receive/list/read/reply/delete; ephemeral tenants

The skill directs deployment file uploads and hosting management through Cohesivity APIs. This intended transfer can disclose project contents to the remote service.

中

SKILL.md:89

Hardcoded URL

- **Billing is a consent gate.** Fetch `https://cohesivity.ai/pricing` for current plans and amounts

This line directs remote pricing retrieval and billing calls after approval. Those calls can create financial commitments, and the top-up operation is not idempotent.

中

SKILL.md:93

Hardcoded URL

Managed agents (private always-on Hermes agents) are claimed-only, spend from the wallet, and are a

The skill links to remote managed-agent instructions for a service that spends from the wallet. Network-driven provisioning therefore carries financial and persistent-state risk.

低

SKILL.md:66

HTTP client library

- **Send a non-default User-Agent** on every request to `cohesivity.ai`, docs included. The WAF reje

The skill requires manual requests to cohesivity.ai to use a non-default User-Agent. This is intentional outbound communication that may expose client-identifying metadata.

低

SKILL.md:14

Hardcoded URL

This skill does not manage its own installation or updates. Whatever delivered it owns that. The can

The skill advertises a canonical remote skill URL that a deliverer may query for updates. This enables intentional outbound traffic and mutable remote content.

低

SKILL.md:31

Hardcoded URL

1. **Control plane** (`https://cohesivity.ai/api/*`): tenant lifecycle, provisioning, billing, statu

This line defines authenticated control-plane requests to cohesivity.ai. Transmitting the management credential is intended service behavior but remains a network and secret-handling risk.

低

SKILL.md:75

Hardcoded URL

2. **Fetch the resource's live doc, then provision through MCP.** Read `https://cohesivity.ai/offeri

The workflow requires fetching live resource documentation and invoking remote MCP provisioning. These network operations are intentional and can alter infrastructure after authorization.

低

SKILL.md:113

Hardcoded URL

- Per-resource API, quirks, limits: `https://cohesivity.ai/offerings/<name>`

The skill directs the agent to fetch per-resource API instructions from cohesivity.ai. This is explicit network access to mutable operational documentation.

低

SKILL.md:114

Hardcoded URL

- Index of everything: `https://cohesivity.ai/llms.txt` (full reference: `llms-full.txt`)

The listed remote indexes are intended to be fetched for service reference. Their contents can change independently of the audited skill.

低

SKILL.md:115

Hardcoded URL

- Pricing and tier limits: `https://cohesivity.ai/pricing`

The pricing URL is an explicit remote dependency used before paid actions. Fetching it is intended network behavior.

低

SKILL.md:116

Hardcoded URL

- Latest skill: `https://cohesivity.ai/skill.md`

The canonical skill URL is a remote update source. Querying it is intentional network access and can expose unaudited content changes.

風險因素

⚙️ 外部命令 (48)

🌐 網路存取 (12)

SKILL.md:66 SKILL.md:14 SKILL.md:31 SKILL.md:32 SKILL.md:75 SKILL.md:82 SKILL.md:89 SKILL.md:93 SKILL.md:113 SKILL.md:114 SKILL.md:115 SKILL.md:116

偵測到的模式

System reconnaissance×2

審計單位: codex

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/cohesivity-org-cohesivity/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/cohesivity-org-cohesivity/security.svg)](https://skillstore.io/skills/cohesivity-org-cohesivity?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/cohesivity-org-cohesivity?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cohesivity-org-cohesivity/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/cohesivity-org-cohesivity.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

cohesivity-org. (2026). cohesivity security audit report (audit version 1) [Author version 2923f0623a63]. Skillstore. https://skillstore.io/skills/cohesivity-org-cohesivity/audits/1

BibTeX 引用

@techreport{cohesivity-org-cohesivity-org-cohesivity-2026,
  author = {cohesivity-org},
  title = {cohesivity security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/cohesivity-org-cohesivity/audits/1},
  note = {Author version 2923f0623a63}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "cohesivity security audit report (audit version 1)"
version: "2923f0623a63"
type: report
authors:
  - name: "cohesivity-org"
date-released: "2026-09-12"
url: "https://skillstore.io/skills/cohesivity-org-cohesivity/audits/1"
identifiers:
  - type: other
    value: "skillstore:cohesivity-org-cohesivity:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

可維護性

內容

社群

規範符合度

你可以打造什麼

Launch an Application Backend

Provision a database, authentication, storage, and hosting for a new application without managing separate provider consoles.

Add Managed Services

Attach Redis, realtime messaging, email, vector storage, or model APIs to an existing project.

Operate Project Infrastructure

Check tenant status, review quotas, claim temporary projects, and perform approved billing actions.

試試這些提示

Create a Basic Backend

Create a Cohesivity backend for my project with Postgres and authentication. Explain the proposed tenant change and wait for required approval.

Add a Managed Service

Inspect this project for an existing Cohesivity configuration. Add Redis using current service documentation and request approval before provisioning.

Deploy a Server Application

Prepare this server application for Cohesivity hosting. Review deployment files, protect secrets, show expected costs, and request approval before upload.

Design a Multi-Service Architecture

Design a Cohesivity architecture using Postgres, vector storage, inbox, realtime, and an AI gateway. Verify live limits and stage every mutation for approval.

最佳實務

Reuse an existing valid tenant and read credentials only from the protected project configuration.
Fetch current resource documentation, summarize the planned effect, and obtain explicit authorization before every mutation.
Keep all Cohesivity keys server-side and redact them from logs, screenshots, chat, and deployment output.

避免

Do not create duplicate tenants when a valid project configuration or MCP tenant already exists.
Do not send direct control-plane mutations that bypass MCP confirmation checks.
Do not retry non-idempotent top-ups or cross billing and durable-state gates without explicit approval.

常見問題

What services can this skill provision?

It covers databases, caching, storage, hosting, authentication, realtime, inbox, browser automation, and selected AI APIs.

Does tenant creation require approval?

Yes. Creating a tenant changes external state, so the current request must explicitly authorize it.

Where are Cohesivity credentials stored?

Local project credentials reside in the .cohesivity file. Remote account credentials remain inside the account MCP.

Can Cohesivity keys be used in browser code?

No. Management and application keys must remain server-side, with a proxy used for browser-only applications.

How long does a new tenant last?

An ephemeral tenant lasts 72 hours and has resource caps. Claiming preserves it after explicit approval.

Does the skill perform paid actions automatically?

No. Billing, upgrades, managed agents, and other paid actions require current pricing disclosure and explicit approval.

開發者詳細資訊

作者

cohesivity-org

授權

MIT

作者版本

v2923f0623a63

Skillstore 修訂

版本提示

作者聲明的版本不符合 SemVer 規範。

儲存庫

https://github.com/cohesivity-org/cohesivity-plugin/tree/357c8bdaa7d2204e714033f5de42befe1e6dbf48/skills/cohesivity

引用

5526951beaeca22519572a471618555839b53b05

維護新鮮度

2026/9/14

使用量

0 次下載 · 0 次瀏覽

檔案結構

📄 SKILL.md