cometchat-troubleshooting
Pass
Audited by Gen Agent Trust Hub on Apr 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
executeBashto run diagnostic and project management commands via the vendor's CLI tool. This includes auditing integration state and applying template restorations.- [REMOTE_CODE_EXECUTION]: The skill executes the latest version of the@cometchat/skills-clipackage directly from the npm registry usingnpxto ensure diagnostic checks are up to date.- [EXTERNAL_DOWNLOADS]: Recommends the installation of a remote Model Context Protocol (MCP) tool from the official CometChat website to assist with symptom-to-cause matching.- [CREDENTIALS_UNSAFE]: Explicitly audits project environment files (e.g.,.env,.env.local) to detect placeholder credentials and hardcoded keys. This behavior is designed to assist users in identifying and remediating security misconfigurations.- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests and processes content from local tool outputs and remote documentation searches.\n - Ingestion points: CLI JSON reports from
cometchat doctorand search results from thecometchat-docsMCP.\n - Boundary markers: Not implemented; the agent is instructed to follow findings directly.\n
- Capability inventory: The skill has access to shell execution (
executeBash) and file modification tools.\n - Sanitization: No specific sanitization or validation of the ingested content is described.
Audit Metadata