cometchat-android-v6-extensions — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cometchat-android-v6-extensions (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Ground truth:features.android-v6.json(the extension entries + theirenablement) + catalogandroid-v6.json+ the live page/ui-kit/android/extensions(the manual — 8 built-ins) and each extension's/fundamentals/*page. Verify symbols against the catalog; fetch details from docs; never invent an extension.
cometchat-android-v6-core — install, credentials, initFromSettings → login → render, the fetch map. Assumed here, never repeated.cometchat-android-v6-features — the general feature-lookup skill; come here for the Dashboard-extension slice specifically."enable stickers/polls/whiteboard/document/translation/link preview/thumbnails", "add message shortcuts", "which extensions work with the Android UI Kit?", "I enabled it in the Dashboard but nothing shows up".
Same kit + initFromSettings → login as core. No Gradle dependency and (for the 7 auto-rendered ones) no client code — the UI Kit detects an enabled extension after init+login and renders it in the right component.
| Extension | Enable | Where it appears once enabled |
|---|---|---|
| Stickers | Dashboard → Extensions | Composer (sticker keyboard → CometChatStickerKeyboard; sent as CometChatStickerBubble) |
| Polls | Dashboard → Extensions | Composer action sheet (CometChatCreatePoll; rendered as CometChatPollBubble) |
| Collaborative Whiteboard | Dashboard → Extensions | Composer action sheet; opens as a collaborative bubble in the list |
| Collaborative Document | Dashboard → Extensions | Composer action sheet; opens as a collaborative bubble in the list |
| Message Translation | Dashboard → Extensions | Message long-press/action sheet in CometChatMessageList |
| Link Preview | Dashboard → Extensions | Automatically inside message bubbles for URLs |
| Thumbnail Generation | Dashboard → Extensions | Automatically on image/video bubbles (smaller previews) |
| Profanity Filter | Dashboard → Extensions | Message bubbles (censored text) — ⚠️ LEGACY |
Message Shortcuts is the one extension that is NOT zero-code: enable it in the Dashboard, then implement a shortcut formatter extending CometChatTextFormatter — build it from the docs recipe /ui-kit/android/shortcut-formatter-guide (→ cometchat-android-v6-{kotlin,compose}-customization for the formatter mechanism).
cometchat-android-v6-{kotlin,compose}-customization.Profanity Filter is LEGACY: the extensions page still lists it, but its guide points at the legacy-docs archive. For new work steer to the Moderation product (features.android-v6.json → moderation, dashboard-configured rules + AI moderation) — say this plainly rather than wiring the legacy path. Anything not in the table above and not in features.android-v6.json does not exist for this kit: don't invent extensions (no "reactions extension" — reactions are core in v6; same for mentions).
Writing client code for an auto-rendered extension (never needed) · hand-rolling polls/stickers UI that the kit already renders · enabling in the Dashboard but not re-logging in · expecting an extension before init+login succeed · offering Profanity Filter for new work · treating reactions/mentions as extensions (they're core in v6) · assuming an extension enabled on one app applies to another (per-app setting).
No catalog/compile change is expected for the auto-rendered ones (nothing was emitted); for Message Shortcuts, compile (./gradlew :app:assembleDebug # in YOUR app (npm run verify:fences:android-v6 is a pack-repo gate)) and confirm the formatter is registered. On device, after enabling + re-login: the extension's entry point is present where the table says (composer action sheet / sticker keyboard / message action sheet / inside the bubble) and a sent artifact renders as its bubble type. Nothing showing ⇒ check init/login succeeded, then the Dashboard toggle for THIS app, then re-login — in that order.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.