Cometchat React V7 Production

What it does

When your agent uses it

• Tasks that involve Product launch strategy

Example prompts

• “is this production ready”
• “auth token instead of auth key react”
• “secure my cometchat react setup”
• “/cometchat-react-v7-production”

Requirements

• Compatibility (from SKILL.md): @cometchat/chat-uikit-react ^7 (7.1.x–7.2.x verified); React 18–19; Vite / Next.js / CRA / React Router / Astro

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

1. 1Your app authenticates the user (your own auth — CometChat is not an identity provider).
2. 2Your server calls CometChat's REST API with the REST API Key to mint an auth token for that user's UID ({DOCS_BASE}/rest-api/auth-tokens).
3. 3The server returns the token to the browser over an authenticated request.
4. 4The app calls loginWithAuthToken(token).

What it can do on your machine

Read from SKILL.md and the folder at commit 911b108. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Shell commands in SKILL.md call:

  • npm

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md. Its commands use npm, which can reach the network depending on how they are called.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

• Compatibility

  @cometchat/chat-uikit-react ^7 (7.1.x–7.2.x verified); React 18–19; Vite / Next.js / CRA / React Router / Astro

  From compatibility in the SKILL.md frontmatter.

Context cost

Cometchat React V7 Production loads about 1.6k tokens when it runs. Until then it costs about 104 tokens; SKILL.md has 716 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~104

When it runs · the whole SKILL.md, loaded when a task matches

~1.6k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NoteMentions a .env fileSKILL.md:49

  s`): Vite `VITE_`, Next `NEXT_PUBLIC_` (`.env.local`), CRA `REACT_APP_`, Astro `PUBLIC_`. App ID and Region are not secr

• NoteMentions a .env fileSKILL.md:53

  Run that in CI — a stray `.env` or a wrong prefix ships the key silently.

• NoteMentions a .env fileSKILL.md:69

  [ ] Correct env prefix for the bundler; `.env` gitignored

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from cometchat/cometchat-skills at commit 911b108, republished under its MIT licence (© cometchat). 716 words, ~1,576 tokens.

name

cometchat-react-v7-production

description

Ship a CometChat React v7 integration safely — server-minted auth tokens instead of the Auth Key, correct env prefixes per bundler, bundle hygiene, and a pre-launch checklist. Triggers: 'is this production ready', 'auth token instead of auth key react', 'secure my cometchat react setup', 'production build config react', 'going live checklist react', 'harden cometchat before launch'.

compatibility

@cometchat/chat-uikit-react ^7 (7.1.x–7.2.x verified); React 18–19; Vite / Next.js / CRA / React Router / Astro

license

MIT

metadata.author

CometChat

metadata.version

1.0.0

metadata.tags

cometchat react v7 production security auth-token hardening deployment

// the endpoint derives the UID from the SERVER session — never from a query param
const res = await fetch("/api/cometchat-token", { credentials: "include" });
const { authToken } = await res.json();
await CometChatUIKit.loginWithAuthToken(authToken);

npm run build && grep -rll "<your-auth-key>" dist/ build/ .next/ 2>/dev/null && echo "LEAK" || echo "clean"

© cometchat, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/cometchat-react-v7-production of cometchat/cometchat-skills.

Open the folder on GitHubat commit 911b108