cometchat-68b7b1 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cometchat-68b7b1 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Ground truth: routing ispeers.yaml(data); shared rules areRULES.md. This is a THIN classifier — detect + dispatch only. No workflows, credential logic, or component detail here; those live incometchat-onboarding+ the resolved family's skills +RULES.md.
User wants to add CometChat to a project, upgrade an existing one, or migrate one off Sendbird / Stream. Triggers: "add chat", "add cometchat", "add voice/video calling", "upgrade my v6 UI Kit to v7", "add chat to my iOS app", "add chat in Swift", "upgrade my v4 iOS UI Kit to v5".
This applies to EVERY agent and EVERY install mode, whether or not a row above matched.
core skill -> references/docs-map.md and follow it to the docs page. Append .md to any docs URL for the clean Markdown twin.Full text: RULES.md -> "Fetch discipline".
npx @cometchat/skills detect --json: each migrate_from entry names the vendor's skill (cometchat-migrate-from-{sendbird,getstream,twilio}, routed in peers.yaml migrations:); a vendor the user NAMES counts even if detect misses it. That skill runs the whole migration in one prompt (detect → replace → remove what CometChat lacks → verify → final list of removed features) and lands on the <family> core itself. "Migrate to CometChat" with neither vendor detected nor named → say no Sendbird/Stream usage was found, then continue at rule 1/2. Data-only ("migrate only my data from Sendbird|Stream", "import my <vendor> users/messages into CometChat") → the same vendor skill in its data-only mode (references/data-only.md): the named vendor is enough (no code detection needed), and it changes only scripts/cometchat-migration/ and writes the COMETCHAT_MIGRATION.md report. Twilio has no data-only mode: say so and offer the full migration, and never change app code on a data-only request. A plain "add chat" on a repo where migrate_from is set → onboarding, which names the vendor in its plan and offers the migration.npx @cometchat/skills detect --json — the authority: existing_cometchat: true means a CometChat UI Kit/SDK dependency is present (@cometchat/chat-uikit-*/chat-sdk-*/calls-sdk-*, com.cometchat:*, cometchat_*, CometChatUIKitSwift). If it can't run, READ the repo for that same dependency. A .cometchat/ folder is NOT evidence — the installer and the dashboard CLI create it. (The dashboard CLI @cometchat/skills-cli has no detect; RULES.md → "The CLI is a dashboard/API client only".) Present ⇒ the plan/approve journey has already happened. Treat the ask as a TASK, not an integration: resolve <family> (rule 4), pick the <type> from the map in rule 5, open that skill directly. This is the COMMON case in a live app — "change my avatar", "add a logout button", "add polls", "restyle the bubble", "my custom view isn't showing" — and none of it is onboarding. Routing it through the gate re-asks questions the user already answered; having NO branch for it is worse, because the agent then falls out of the flow and guesses from node_modules (AUDIT-106).-core skill for a first-contact add request — onboarding gates it. (Onboarding short-circuits on an already-integrated repo — see its Re-entry section.)cometchat-<family>-migration (that IS the reconciliation). The version_conflict STOP still applies to add requests; onboarding surfaces it in the plan and reconciles before hand-off.cometchat-<family>-<type>. Take <family> from the dir_prefix of the matching row in peers.yaml — the detect probe's framework, else its detect_signals against what you READ (package.json/lockfile, angular.json, settings.gradle(.kts) + app/build.gradle(.kts), pubspec.yaml, *.xcodeproj/*.xcworkspace/Package.swift): React web → react-v7; Angular (angular.json detected) → angular-v5; React Native / Expo → react-native; Android (settings.gradle(.kts) detected) → android-v6 (a calls-sdk-android-only / "calling from scratch" ask → the android-calls row, cometchat-android-v5-calls-sdk); Flutter (pubspec.yaml) → flutter-v6; iOS → ios. Routing a project to another family's skill is a defect — a React Native app sent to a react-v7 skill gets web-only APIs that do not exist on native (no UIKitSettingsBuilder, login takes an object, callbacks are on*Press not on*Click), and the reverse is equally broken. If no row matches the detected framework, say the platform is not in this pack — do NOT substitute the nearest one.<type> below, always under the resolved <family>:cometchat-<family>-componentscometchat-<family>-placementcometchat-<family>-customizationcometchat-<family>-featurescometchat-<family>-callscometchat-<family>-push (THIN + docs-first — fetches the notifications docs; live delivery is a manual device check)cometchat-<family>-migrationcometchat-<family>-patterns on react-v7 (Vite/Next/CRA/React Router/Astro), angular-v5, flutter-v6. react-native: the split pair cometchat-react-native-expo-patterns (Expo) / cometchat-react-native-bare-patterns (RN CLI/bare) — pick by whether expo is a dependency. iOS and Android have NO patterns skill.cometchat-analytics.cometchat-audit (read-only; routes fixes to the owning skills).cometchat-a11y. localization / i18n / translate the UI / RTL → cometchat-i18n. (Cross-family, installed for every family.)cometchat-security (cross-family: server + access-control model; client login stays in the family core/production). data residency / GDPR / retention / audit logs / eDiscovery → cometchat-compliance. on-prem / self-host / private cloud → cometchat-self-host. moderation / safety / profanity / image moderation → cometchat-moderation. These four are installed for every family (like onboarding).cometchat-<family>-{production,testing,troubleshooting} on every UI family (react-v7, angular-v5, react-native, ios, android-v6, flutter-v6). events → android-v6, flutter-v6.cometchat-react-native-sdk (the method→contract fallback map; kit v5 removed the detail/management screens, so SDK calls are on the main road for RN, not an escape hatch).kotlin-* = XML Views, compose-* = Jetpack Compose): cometchat-android-v6-{kotlin,compose}-{components,placement,customization}; also builder-settings, extensions. Headless Chat SDK v5 (build-your-own-UI) → cometchat-android-v5-sdk.cometchat-js-v5-sdk (web) · cometchat-react-native-v5-sdk · cometchat-ios-v5-sdk · cometchat-android-v5-calls-sdk · cometchat-flutter-v5-sdk. Not installed? npx @cometchat/skills add --family <js|react-native|ios|android|flutter>-calls adds it alongside the UI Kit skills. The prebuilt call UI stays cometchat-<family>-calls.For a framework with no core yet (Vue today), onboarding still delivers the plan and states the platform's core isn't built. Angular IS built — @angular/core/angular.json matches the angular row in peers.yaml; route to that row's dir_prefix + core and the rest of its family (v5 kit, catalog-verified vs 5.1.0); never tell an Angular user their platform is unsupported.
Routing data: peers.yaml. Rules: RULES.md. This file stays small on purpose.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.