How do I install the Cognitum Spaces skill?

Run npx skillmds@latest add gabrielmoreira/cognitum-spaces in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Cognitum Spaces skill do?

Cognitum Spaces OAuth activation It is listed under Integrations & APIs on SkillMD.

Is Cognitum Spaces safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: CAUTION, Skill Scanner: PASS. Capability flags: makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cognitum Spaces?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cognitum Spaces free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cognitum Spaces?

gabrielmoreira (@gabrielmoreira) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cognitum Spaces by gabrielmoreira — Agent Skill

Name: Cognitum Spaces
Rating: 4.2 (5 reviews)
Author: gabrielmoreira

File contents

Cognitum Spaces OAuth activation

Use this playbook to activate and inspect the tenant-scoped Cognitum Spaces projection without giving an agent a bearer token or API key.

Boundary

This is a read-only P2/P3 semantic projection. HomeCore Edge remains authoritative.
Raw CSI, CIR, RF tensors, recordings, pose frames, vital waveforms, and identity observations are prohibited.
spaces:read grants no pairing, publication, write, command, policy approval, spending, or actuator authority.
A read may refresh an expiring OAuth session and atomically rotate the local credential file.

Activate OAuth explicitly

Install or build the wifi-densepose CLI, then request the additional scope:

wifi-densepose login --spaces

For a terminal without a browser:

wifi-densepose login --spaces --no-browser

Confirm that the account reports spaces:read, then list through the metaharness:

wifi-densepose whoami
npx @ruvnet/ruview spaces
npx @ruvnet/ruview spaces --resource sites
npx @ruvnet/ruview spaces --resource events --limit 25

The versioned collections are sites, buildings, floors, spaces, zones, entities, events, and alerts. Continue a page with the returned opaque nextCursor; do not decode or reuse a cursor for another collection.

Use --credentials-path <private-file> only from the human-invoked CLI when a non-default credential store is intentional. Never put a bearer token or API key on the command line.

MCP

The tool is ruview_spaces_list. It is denied by default even though the cloud operation is read-only, because it consumes a local identity credential and contacts an external service. The MCP server operator must grant that capability and may bind the credential path in the server environment:

RUVIEW_MCP_GRANTS=credential-use \
RUVIEW_CREDENTIALS_PATH=/private/ruview/credentials.json \
npx @ruvnet/ruview mcp start

MCP calls cannot choose a credential path and the tool schema has no token or API-key, workspace override, or base-URL field. The API origin is fixed to https://api.cognitum.one, the adapter requires an installed wifi-densepose binary, and the child environment excludes COGNITUM_SPACES_API, so this surface verifies the OAuth path rather than silently taking the compatibility API-key path.

Interpret results honestly

An empty data list can be a valid authenticated tenant result. It proves the read path and isolation behavior, not sensing quality. Every accepted response must declare HomeCore Edge as authoritative and carry the complete prohibited field list. Parent lineage, schema version, anonymous person/track identity, event/alert fields, confidence, and cursor bounds are independently checked. Any malformed, oversized, non-semantic, or raw-field response fails closed.

---name: cognitum-spacesdescription: Cognitum Spaces OAuth activation---# Cognitum Spaces OAuth activationUse this playbook to activate and inspect the tenant-scoped Cognitum Spacesprojection without giving an agent a bearer token or API key.## Boundary- This is a read-only P2/P3 semantic projection. HomeCore Edge remains authoritative.- Raw CSI, CIR, RF tensors, recordings, pose frames, vital waveforms, and identity observations are prohibited.- `spaces:read` grants no pairing, publication, write, command, policy approval, spending, or actuator authority.- A read may refresh an expiring OAuth session and atomically rotate the local credential file.## Activate OAuth explicitlyInstall or build the `wifi-densepose` CLI, then request the additional scope:```bashwifi-densepose login --spaces```For a terminal without a browser:```bashwifi-densepose login --spaces --no-browser```Confirm that the account reports `spaces:read`, then list through themetaharness:```bashwifi-densepose whoaminpx @ruvnet/ruview spacesnpx @ruvnet/ruview spaces --resource sitesnpx @ruvnet/ruview spaces --resource events --limit 25```The versioned collections are `sites`, `buildings`, `floors`, `spaces`,`zones`, `entities`, `events`, and `alerts`. Continue a page with the returnedopaque `nextCursor`; do not decode or reuse a cursor for another collection.Use `--credentials-path <private-file>` only from the human-invoked CLI when anon-default credential store is intentional. Never put a bearer token or APIkey on the command line.## MCPThe tool is `ruview_spaces_list`. It is denied by default even though the cloudoperation is read-only, because it consumes a local identity credential andcontacts an external service. The MCP server operator must grant that capabilityand may bind the credential path in the server environment:```bashRUVIEW_MCP_GRANTS=credential-use \RUVIEW_CREDENTIALS_PATH=/private/ruview/credentials.json \npx @ruvnet/ruview mcp start```MCP calls cannot choose a credential path and the tool schema has no token orAPI-key, workspace override, or base-URL field. The API origin is fixed to`https://api.cognitum.one`, the adapter requires an installed`wifi-densepose` binary, and the child environment excludes`COGNITUM_SPACES_API`, so thissurface verifies the OAuth path rather than silently taking the compatibilityAPI-key path.## Interpret results honestlyAn empty `data` list can be a valid authenticated tenant result. It proves theread path and isolation behavior, not sensing quality. Every accepted responsemust declare `HomeCore Edge` as authoritative and carry the complete prohibitedfield list. Parent lineage, schema version, anonymous person/track identity,event/alert fields, confidence, and cursor bounds are independently checked.Any malformed, oversized, non-semantic, or raw-field response fails closed.

Frequently asked questions

Cognitum Spaces