cometchat-ios-features

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs users to supply an OpenAI API key via a CLI flag (e.g., --openai-key sk-...), which encourages embedding the secret verbatim in commands and thus requires the LLM to handle/output secret values directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill documents runtime behaviors that fetch and parse arbitrary user-shared URLs (Link Preview: "Automatically generates previews for URLs shared in messages") and ingest user-generated conversation content into AI features (CometChat.getConversationSummary and AI Assistant/bot), so untrusted third-party content is read/interpreted and can influence AI-generated replies or subsequent actions.