cometchat-angular-v5-core

This is setup guidance, not executable malware, and it shows no unauthorized network or system activity. Its significant security risk is instructing developers to place a development Auth Key in Angular client configuration, where it can be exposed in browser build artifacts despite gitignore rules. The optional `npx @cometchat/skills-cli@3` flow retrieves credentials and stores its login bearer in the OS keychain; the fragment provides no evidence that these credentials are sent to an unrelated destination. Severity: security warning; do not include an Auth Key in client-delivered builds.