The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses executeBash to run npx @cometchat/skills-cli and npm install. These operations are limited to official vendor tools and packages used for verifying integration status and installing calling capabilities.
[EXTERNAL_DOWNLOADS]: The skill installs the @cometchat/calls-sdk-javascript package and references an external Model Context Protocol (MCP) for documentation hosted on the official CometChat domain.
[DATA_EXPOSURE]: The skill reads project-specific configuration from .cometchat/state.json and searches local source files to identify active UI components. This data is used locally to guide feature implementation.
[INDIRECT_PROMPT_INJECTION]: The skill identifies a surface for indirect injection as it processes file lists and source code content from the local project to determine modification targets.
Ingestion points: The files_owned array in .cometchat/state.json and the output of grep commands on local source code.
Boundary markers: Absent; the skill relies on internal CLI logic for parsing project data.
Capability inventory: executeBash for CLI operations and readFile for inspecting project state.
Sanitization: Not explicitly implemented within the skill instructions, as the heavy lifting is delegated to the vendor's CLI tool.

cometchat-features