cometchat-a11y
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill implements a live region announcer that processes incoming message data (New message from ${senderName}: ${text}). This creates an indirect prompt injection surface where untrusted data from the chat stream enters the application context. * Ingestion points: onTextMessageReceived listener in SKILL.md. * Boundary markers: Absent in the example code snippets. * Capability inventory: The skill's allowed tools include shell, file-read, file-search, file-list, and ask-user. * Sanitization: Not explicitly implemented in the provided educational templates.
- [SAFE]: External dependencies and tools mentioned, such as @axe-core/playwright and @cometchat/chat-sdk-javascript, are legitimate vendor resources or well-known industry standards.
- [SAFE]: The skill uses standard platform APIs and CSS media queries to implement accessibility features across various frameworks.
Audit Metadata