Cohesivity

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:34 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Cohesivity backend-infrastructure integration, but users should understand it creates project credentials and makes external service calls.

Install this only if you are comfortable with an agent using Cohesivity as an external backend provider. Expect a .cohesivity file containing secrets in the project root, keep it out of client code and version control, and require explicit approval before claiming tenants, paid resources, upgrades, or managed agents.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:30

Finding

Long-Lived Application Credential Exposed in URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 30
Vulnerability Type: Credential exposure through URL query parameters
Risk Level: Medium

Vulnerable Code

markdown

2. **Data plane** (`https://cohesivity.ai/edge/*`): runtime calls to provisioned services from the tenant app. Auth: `?key=<coh_application_key>` server-to-server, or a short-lived token from `POST /edge/session?key=<coh_application_key>`.

Technical Analysis

The Skill directs callers to place the long-lived coh_application_key in URL query parameters for both ordinary data-plane requests and requests that create short-lived sessions.

Query parameters are routinely captured in reverse-proxy access logs, application server logs, observability platforms, debugging traces, error reports, network monitoring systems, and shell histories. Server-to-server use reduces browser-specific exposure but does not prevent infrastructure and telemetry systems from recording complete URLs.

This exposure is unnecessary because the credential can instead be supplied through an HTTP authorization header. The behavior therefore creates more secret exposure than is required for the declared data-plane functionality.

Attack Path

1. The Agent reads coh_application_key from the project's .cohesivity file.
2. It constructs a request such as https://cohesivity.ai/edge/<service>?key=coh_app_....
3. A reverse proxy, HTTP server, monitoring agent, debugging tool, or error-reporting platform records the complete URL.
4. An attacker or unauthorized operator with access to that record extracts the application key.
5. The attacker replays the key against enabled Cohesivity data-plane endpoints.
6. The attacker retains access until the credential expires, is revoked, or is rotated.

Impact Assessment

A leaked application key may permit unauthorized invocation of the tenant's provisioned data-plane services. Depending on which services are enabled and their API authorization m ...[truncated 344 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace query-string authentication with an HTTP header, preferably:

   http

   Authorization: Bearer <coh_application_key>
   

2. Apply header-based authentication to both regular /edge/* calls and the /edge/session endpoint.

3. Prefer narrowly scoped, short-lived tokens for individual services and operations rather than exposing a tenant-wide application credential on every request.

4. Ensure reverse proxies, application servers, monitoring systems, and error-reporting services redact authorization data and URL query strings.

5. Document application-key revocation and rotation procedures, and provide a way to invalidate a suspected leaked key immediately.

6. Limit each application key to the minimum services and actions required by the deployed application.

7. During migration, reject credentials supplied through query parameters after a short deprecation period to prevent continued insecure usage.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill’s applicability guidance is broad enough to trigger on many generic app-building requests, which can cause the agent to steer users toward this backend even when the user did not specifically request it. In a security-sensitive agent environment, over-broad activation increases the chance of unnecessary infrastructure provisioning, external network calls, and creation of credential-bearing .cohesivity files in projects where this integration may not be appropriate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.