neo4j-aura-provisioning-skill
Provisions and manages Neo4j Aura instances via CLI (aura-cli v1.7+) or REST API. Use when creating, pausing, resuming, resizing, or deleting AuraDB Free/Professional/Business Critical/VDC instances; downloading credentials; scripting CI/CD pipelines; polling async status; or using the Terraform neo4j/neo4j-aura provider. Covers auth setup (client credentials OAuth2), credential lifecycle (download once — never recoverable), instance type selection, region codes, and Python provisioning scripts. Does NOT handle Cypher queries — use neo4j-cypher-skill. Does NOT cover Graph Data Science algorithms — use neo4j-gds-skill or neo4j-aura-graph-analytics-skill. Does NOT cover neo4j-admin/cypher-shell — use neo4j-cli-tools-skill.
80
92%
Does it follow best practices?
Impact
100%
1.78xAverage score across 1 eval scenario
High
Do not use without reviewing
Security
2 findings: 1 high severity, 1 medium severity. You should review these findings carefully before considering using this skill.
W007: Insecure credential handling detected in skill instructions.
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
The skill explicitly extracts and stores initial passwords/tokens and directs the agent to write them into .env and to print or echo them (e.g., bash jq extraction, cypher-shell -p, Python print of instance['password'], aura-cli/curl using client secret), which requires handling and outputting secret values verbatim and creates an exfiltration risk.
W013: Attempt to modify system services in skill instructions.
What this means
The skill prompts the agent to compromise the security or integrity of the user’s machine by modifying system-level services or configurations, such as obtaining elevated privileges, altering startup scripts, or changing system-wide settings.
Why it was flagged
The skill explicitly instructs running "sudo mv aura-cli /usr/local/bin/" which requests elevated (sudo) privileges to modify system-level paths, so it directs changes to the machine's state requiring admin rights.
- Repository
- neo4j-contrib/neo4j-skills
- Commit
a9a5e78
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.