cometchat-native-calls
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the
@cometchat/calls-lib-webrtcpackage directly from CometChat's official Cloudsmith repository (dl.cloudsmith.io). This is documented as a necessary step because the package is not hosted on the public NPM registry. As the source belongs to the skill's author (CometChat), this is a standard vendor dependency distribution method. - [INDIRECT_PROMPT_INJECTION]: The skill implements listeners that process incoming custom messages and call events from the CometChat platform to trigger UI transitions (e.g., showing a 'Join' button or ringing screen). The code examples demonstrate best practices by validating the message category (
CometChat.CATEGORY_CUSTOM) and type ('meeting') before taking action, which mitigates risks from malicious or malformed message data. - [COMMAND_EXECUTION]: The skill provides terminal commands for package installation and project configuration (e.g.,
npm install,pod install,npx expo prebuild). These are standard development tasks for React Native projects. It also includes a Metro configuration patch to resolve a specific module resolution issue in the SDK's build, which is a common build-time adjustment for React Native developers.
Audit Metadata