What is cometchat-security?

A security guide for CometChat, a chat service, covering sign-in through an external identity provider, server-created access tokens, session control, and role-based permissions. It explains how a server connects an organisation's identity system to CometChat access.

Use it to plan SSO with SAML or OIDC, mint and revoke tokens, manage sessions, define roles, and restrict access to chat groups or tenants.

It helps avoid mixing up identity-provider login, server credentials, user tokens, and permissions. That reduces access-control mistakes when preparing a chat integration for security review.

cometchat-security — Skill for Claude Code by cometchat

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add cometchat/cometchat-skills --skill cometchat-security

Clone the repo

git clone --depth 1 https://github.com/cometchat/cometchat-skills

Made for: Claude Code.

Or install cometchat-skills, the plugin that ships this one along with the rest of its 98 skills, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/cometchat/cometchat-skills/cometchat-security/github.svg)](https://agentmods.dev/skills/cometchat/cometchat-skills/cometchat-security)

Your own site

<a href="https://agentmods.dev/skills/cometchat/cometchat-skills/cometchat-security"><img src="https://agentmods.dev/badge/skills/cometchat/cometchat-skills/cometchat-security/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/cometchat/cometchat-skills/cometchat-security"><img src="https://agentmods.dev/badge/skills/cometchat/cometchat-skills/cometchat-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 153 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,979 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00153	$0.01979
Opus 5.5	$0.00061	$0.00792
Sonnet 5.5	$0.00031	$0.00396
Haiku 4.5	$0.00015	$0.00198

Measured 24d ago against content hash 635255914f6b, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

cometchat-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 24d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/cometchat-security/SKILL.md · 81 lines

How it starts

The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Ground truth: every REST shape here is FETCHED from the live docs — {DOCS_BASE}/rest-api/auth-tokens, /rest-api/roles, /rest-api/rbac-overview, /rest-api/users, /rest-api/group-members (DOCS_BASE = https://www.cometchat.com/docs; append .md for the raw twin). CometChat is NOT an identity provider — it does not do SAML/OIDC for your end users. "SSO with CometChat" means your IdP authenticates the user, then your server mints a CometChat auth token for that user's UID. Verify signatures against the docs; never invent an endpoint.

Use this skill when

Taking a CometChat integration through an enterprise security review: SSO with your IdP, role-based permissions, session revocation, multi-tenant isolation, or "make our chat secure/compliant to ship." Client-side login wiring itself lives in cometchat-<family>-core / -production; this skill owns the server + access-control model those depend on.

The auth model (get this right first)

Three credentials, three homes — mixing them up is the #1 security defect:

Credential	Who holds it	Purpose
Auth Key	client, dev only	quick `login(uid)` in development; can mint a session for ANY user — never ship it
Auth token	client, per user	production login with a per-user token — the call is per family (web/Angular/Android/Flutter `loginWithAuthToken(token)`, iOS `login(authToken:)`, React Native `login({ authToken })`); tied to one UID; revocable
REST API Key	server only	mint tokens, manage users/roles; full power — never in a client

Production login is always auth token, never the Auth Key. Detail + the per-framework client call: cometchat-<family>-production.

SSO / OIDC / SAML — through YOUR IdP

CometChat rides on the identity you already have. The flow is the same whether your IdP is Okta, Auth0, Cognito, Entra ID, Google Workspace, or your own:

The user signs in through your IdP (SAML/OIDC) — your normal app auth.
Your backend, on that authenticated session, maps the IdP subject to a CometChat UID (a stable, sanitized id — see cometchat-migrate-from-* toCometChatId for the alpha-dash/≤100/lowercase rules) and, if the user is new, creates it (POST {DOCS_BASE}/rest-api/users, withAuthToken: true returns a token in the same call).
Your backend mints an auth token: POST /v3/users/{uid}/auth_tokens with the REST API Key ({DOCS_BASE}/rest-api/auth-tokens/create).
It returns the token to the client over the authenticated request; the client logs in with it via its per-family call (web/Angular/Android/Flutter loginWithAuthToken(token), iOS login(authToken:), React Native login({ authToken }) — see cometchat-<family>-production).

Read the full file on GitHub · 81 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

24d ago First seen · 81 lines · 153 tokens per session scan A 635255914f6b

Subscribe to this mod's changes

cometchat-security is a skill published in the GitHub repository cometchat/cometchat-skills (149 stars, last pushed 2d ago), licensed MIT. It adds 153 tokens to every session and 1,979 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-24.

Backend and APIs Claude Code Security agent-skills ai-agent chat cometchat cursor

cqrs-implementation

Implement Command Query Responsibility Segregation for scalable architectures. Use when separating read and write models, optimizing query performance, or building event-sourced systems.

wshobson/agents · 35 tokens

microservices-patterns

Design microservices architectures with service boundaries, event-driven communication, and resilience patterns. Use when building distributed systems, decomposing monoliths, or implementing microservices.

wshobson/agents · 38 tokens

diagnose-backend-bug

Diagnose a bounded backend or multi-service failure from GitHub Issues, Jira, Aone, user-provided exports, logs, traces, responses, stack traces, or job records. Use when a service, API, RPC, worker, queue, CLI, or scheduled job bug needs correlation through the project's existing observability route before repair; do…

QoderAI/better-harness · 87 tokens

cometchat-security