Cognee is an AI memory platform that stores information in a self-hosted knowledge graph so agents can retain context across sessions. It ingests data, connects related information, and helps agents retrieve it for reasoning and actions. The catalogue includes skills and instructions that extend agent workflows around Cognee.
Borrowing it
Nothing to install: this file belongs to topoteretes/cognee. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/topoteretes/cognee/main/.claude/skills/cognee-permissions/SKILL.mdgit clone --depth 1 https://github.com/topoteretes/cogneeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/topoteretes/cognee/cognee-permissions)<a href="https://agentmods.dev/skills/topoteretes/cognee/cognee-permissions"><img src="https://agentmods.dev/badge/skills/topoteretes/cognee/cognee-permissions/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/topoteretes/cognee/cognee-permissions"><img src="https://agentmods.dev/badge/skills/topoteretes/cognee/cognee-permissions.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Snyk pass
- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 146 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 147 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 148 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium Tool Misuse · line 25 Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.Fix: Override unsafe defaults with secure settings (verify=True, auth required, restrictive permissions). Review and harden all tool configurations.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00062 | $0.02094 |
| Opus 5 | $0.00031 | $0.01047 |
| Sonnet 5 | $0.00012 | $0.00419 |
| Haiku 4.5 | $0.00006 | $0.00209 |
Grade A, and why
cognee-permissions scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 166 lines — stays where its author put it; the contents beside it link to each section on GitHub.
The cognee permission system
The master switch
ENABLE_BACKEND_ACCESS_CONTROL decides whether any of this runs:
true(default): multi-tenant mode. Every API call requires auth, every dataset operation is permission-checked, and each user+dataset pair gets isolated graph/vector/relational databases (tracked in theDatasetDatabasemodel, supported backends: Kuzu, LanceDB, SQLite, Postgres).false: single-user mode. Permission checks short-circuit to allowed, there is no per-dataset isolation, and every user's operations resolve to the same shared databases and datasets. Authentication is a separate knob:REQUIRE_AUTHENTICATION. Unset, it inherits this switch (so turning access control off also turns auth off) — but ifREQUIRE_AUTHENTICATION=trueis set, endpoints still demand a login; authenticated users are identified but not isolated, all pointing at the same data. The reverse misconfiguration (REQUIRE_AUTHENTICATION=falsewith access control on) is ignored: auth is forced on with a warning, because multi-tenant isolation is meaningless without identity (get_authenticated_user.py).
The core model: principals, permissions, ACL grants
Everything reduces to one relation — a grant: principal × permission
× dataset, stored as one ACL row (modules/users/models/ACL.py).
- Principal (
Principal.py) is polymorphic:User,Role, andTenantall inherit from it. Any of the three can hold a grant, which is how role-wide and tenant-wide access work — one ACL row covers every member. - Permission (
Permission.py) is one of exactly four names, defined inpermissions/permission_types.py:read,write,delete,share.shareis the meta-permission: it gates granting/revoking access for others. - Membership is separate from grants:
UserRoleandUserTenantlink users into roles/tenants. A user's effective access is the union of their own grants and the grants of every role/tenant they belong to.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 166 lines · 62 tokens per session scan A a3be7a043a83
cognee-permissions is a skill published in the GitHub repository topoteretes/cognee (30,610 stars, last pushed today), licensed Apache-2.0. It adds 62 tokens to every session and 2,094 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
openmemory
Manage persistent memory via OpenMemory MCP. TRIGGER when: user says "remember this", "save to memory", "store this", "recall", "what do you remember about", "check memory", "forget this", "delete memory", "clean up memory", or when agent forms a stable conclusion worth persisting. DO NOT TRIGGER when: user refers to…
reflex-create
Use when the user notices a recurring pattern they want the system to learn ("I keep doing X", "every time Y happens", "make this automatic", "remember to always"), or when explicit phrases like "/reflex-create", "create reflex", "teach yourself" are used. Generates a new SKILL.md file from observed patterns.
surface-learnings
Use when the user asks "what have you learned", "what do you remember about me", "show me memory stats", "memory state", "/reflexes", or any variant. Surfaces what the limbic engine has accumulated as patterns, not as a memory dump.
context-recovery
Use at the start of every session, and especially after context compaction or a cold restart. Fires as the first action, before engaging with the user's opening message.
emotional-calibration
Use when the user's message carries emotional valence — frustration, excitement, exhaustion, urgency, or confusion. Fires whenever tone matters more than information.
habituation-check
Use when tempted to repeat the same praise, the same status report, the same explanation, or the same reassurance. Fires as a suppression gate — not all repetition is useful.