cometchat-ios-testing — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cometchat-ios-testing (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Ground truth:CometChatUIKitSwift5.1.22 +CometChatSDK4.1.7 (symbols verified vscatalogs/ios-v5.json); signatures FETCHED viacometchat-ios-core/references/docs-map.md. The iOS UI Kit docs have no dedicated testing page — this is the pack's own guidance (tracked DOCS GAP). The kit ships prebuilt view controllers/SwiftUI views; do not assert against their internal view hierarchy.
cometchat-ios-core — the init→login→render lifecycle and the credential flow these tests exercise.Adding tests around a CometChat iOS integration, or a "how do I test this" question. NOT part of a normal build — only when tests are explicitly requested (RULES.md → Verification scope).
Test your code, not the kit. Three layers:
XCTest in isolation, keep the SDK off the network.XCUITest against a test app, not a unit test.Do not unit-test that the kit's message list renders — that is the kit's own surface.
Put your CometChat calls behind a protocol your view-models depend on, and inject a fake in tests:
protocol ChatAuthing { func login(authToken: String) async throws -> String } // returns uid
final class FakeChatAuth: ChatAuthing { func login(authToken: String) async throws -> String { "u1" } }Test your token-fetch, error handling, and UID mapping against FakeChatAuth — no real CometChatUIKit.login, no network, no Auth Key in the test target. Injecting the real implementation only in the app keeps unit tests fast and hermetic.
The chat screen mounts only after initFromSettings + login resolve (both async). A test that asserts immediately after presenting the screen races the gate — wait for a stable, YOUR-owned element (a title, an accessibility identifier you set), with an expectation/timeout, not a fixed sleep:
let list = app.otherElements["conversationsScreen"] // an identifier YOU set on your container
XCTAssertTrue(list.waitForExistence(timeout: 20))Set accessibilityIdentifiers on your own containers so UI tests have stable anchors that survive kit updates.
One high-value path against a real test app (seeded users; a test-only Auth Key supplied via the scheme's env, never the release config): launch, sign in, assert the conversation screen appears and a message can be sent. Assert on your accessibility identifiers and visible text — never the kit's internal view tree. Keep it to the happy path + one auth-failure path.
Kit view internals, exhaustive option matrices, live calls/VoIP push (device- and entitlement-dependent), and screenshot snapshots of kit UI (they churn across kit versions). Spend the budget on your token flow, UID mapping, and the init-gate wiring.
accessibilityIdentifiers.Unit tests pass with a fake auth (no network, no Auth Key in the target) · a host-app/UI test waits out the init gate and finds your identified container · the XCUITest smoke signs in and shows conversations against a test app · no test asserts a kit-internal view.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.