Agent skill · security · jeremylongshore
cohere-security-basics
Apply a Cohere security baseline for keys, tenant isolation, input controls, output handling, safety modes, and logs. Use when building or reviewing a Cohere integration. Trigger with "Cohere security", "secure Cohere key", or "Cohere safety review".
Why this skill is useful
Provides specific procedures for API key management and security practices tailored to the Cohere platform that the AI wouldn't generate reliably on its own.
What it needs
Requires cohere account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Cohere Security Baseline Overview Protect the credential and the data path around the model; safety modes complement but do not replace application security controls. Prerequisites The target repository, runtime, environment, and accountable owner An approved Cohere team and key for any live verification Current quality, security, privacy, capacity, and change-control requirements Tool Discipline Use Read, Glob, and Grep to inspect code, configuration, and evidence. Use WebFetch only for current Cohere primary documentation. Use Write or Edit only when the user requested implementation and the exact target files are known; never write credentials or customer content. Current Contract Keep keys in an approved secret manager, separate them by environment, and rotate on exposure. Authorize retrieval and tool execution in application code before any data leaves its trust boundary. Cohere safety modes are model- and feature-dependent; tools or documents can constrain the available mode. Treat model output, citations, tool arguments, and retrieved text as untrusted data. Authentication Use an environment-specific key injected from an approved secret manager. Never print, persist, commit, or place COAPIKEY in an example. Confirm access with the least costly bounded operation appropriate to the task, and treat key creation, rotation, revocation, role changes, and production-capacity requests as owner-approved actions. Instructions 1. Map data classes, tenants, endpoints, tools, logs, and credential owners. 2. Enforce server-side key injection, outbound host allowlisting, timeouts, and request-size limits. 3. Apply tenant filters before retrieval and authorize every tool call independently of model intent. 4. Choose and test the supported safety mode for each resolved model and feature combination. 5. Redact logs and validate output before rendering, persistence, or side effects. 6. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/cohere-security-basics