cometchat-troubleshooting

Pass

Audited by Gen Agent Trust Hub on Apr 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses executeBash to run diagnostic and project management commands via the vendor's CLI tool. This includes auditing integration state and applying template restorations.- [REMOTE_CODE_EXECUTION]: The skill executes the latest version of the @cometchat/skills-cli package directly from the npm registry using npx to ensure diagnostic checks are up to date.- [EXTERNAL_DOWNLOADS]: Recommends the installation of a remote Model Context Protocol (MCP) tool from the official CometChat website to assist with symptom-to-cause matching.- [CREDENTIALS_UNSAFE]: Explicitly audits project environment files (e.g., .env, .env.local) to detect placeholder credentials and hardcoded keys. This behavior is designed to assist users in identifying and remediating security misconfigurations.- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests and processes content from local tool outputs and remote documentation searches.\n
  • Ingestion points: CLI JSON reports from cometchat doctor and search results from the cometchat-docs MCP.\n
  • Boundary markers: Not implemented; the agent is instructed to follow findings directly.\n
  • Capability inventory: The skill has access to shell execution (executeBash) and file modification tools.\n
  • Sanitization: No specific sanitization or validation of the ingested content is described.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 28, 2026, 02:50 AM