[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6MFAXFAJY8KM2ECQH09ME5V":3,"skill-same:01M6MFAXFAJY8KM2ECQH09ME5V":75},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":51,"commitSha":52,"skillDirectory":53,"forksCount":54,"repositoryHtmlUrl":55,"repositoryHomepageUrl":56,"ownerHtmlUrl":57,"ownerBlogUrl":58,"ownerDescription":59,"updatedAt":60,"install":61,"resources":74},"01M6MFAXFAJY8KM2ECQH09ME5V","cometchat-flutter-v6-production",null,"Take a CometChat Flutter integration to production — server-minted auth tokens instead of the Auth Key, secret handling in a Flutter bundle, logout\u002Fsession hygiene, release build config, and the pre-ship checklist. Triggers: 'production auth cometchat', 'auth token flutter', 'is the auth key safe', 'ship cometchat to production', 'release build cometchat'.","hashgraph-online\u002Fawesome-codex-plugins","hashgraph-online","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F160371962?v=4","01M6CNB6NRJVNNGN14TR01Q6D3","HOL (Hashgraph Online)","01M6JT1HSKKG9V68KQAQGBA7XP",1575,"MIT","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Fcometchat\u002Fcometchat-skills\u002Fskills\u002Fcometchat-flutter-v6-production\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"Production","cometchat flutter v6 production","flutter","cometchat","auth tokens","pre-ship","uikit","triggers","session","tokens","ship checklist","ship","security","verified","take","token","safe","config","release","secret handling","server","auth","2026-11-10 10:12:30",false,"---\nname: cometchat-flutter-v6-production\ndescription: \"Take a CometChat Flutter integration to production — server-minted auth tokens instead of the Auth Key, secret handling in a Flutter bundle, logout\u002Fsession hygiene, release build config, and the pre-ship checklist. Triggers: 'production auth cometchat', 'auth token flutter', 'is the auth key safe', 'ship cometchat to production', 'release build cometchat'.\"\nlicense: \"MIT\"\ncompatibility: \"Flutter >=3.38.9; cometchat_chat_uikit ^6.2.0 (6.2.x; catalog compiler-verified vs 6.1.0, source-checked vs 6.2.0); cometchat_sdk ^5.0.8\"\nmetadata:\n  author: \"CometChat\"\n  version: \"1.0.0\"\n  tags: \"cometchat flutter production auth-token security release v6\"\n---\n\n> **Ground truth:** `loginWithAuthToken` and `logout` are catalog-verified against 6.1.0. Token MINTING is a server-side REST call — its exact endpoint is FETCHED from the REST API docs, never guessed. The dev-vs-prod credential rule is `RULES.md` §4.\n\n## Companion skills (read first)\n- `cometchat-flutter-v6-core` — install, credentials, `init→login→render`, `lifecycle.md`. This skill ASSUMES it.\n- `cometchat-flutter-v6-patterns` — where config comes from in your build pipeline.\n- `cometchat-security` — the enterprise auth model this client-side hardening plugs into: wiring your IdP \u002F SSO into the token flow (your IdP → your server → mint the CometChat auth token; CometChat is **not** an IdP), token expiry\u002Frefresh + re-login, RBAC roles + group (SBAC) scopes, and Auth Key vs auth token vs REST API Key. Load it for a security review or any SSO question.\n\n## Use this skill when\nHardening before release: \"is the Auth Key safe to ship\", \"set up production auth\", \"what do I check before shipping\".\n\n## Prerequisites & install\nCore done. No new package.\n\n## The one thing that actually matters: the Auth Key must not ship\nAn **Auth Key can log in as ANY user of your app.** Everything core writes for development puts it in `cometchat-settings.json`, which is bundled into the APK\u002FIPA — and a bundle is not a secret. Anyone can extract it.\n\n**Development (what core wired):** `credentials.authKey` in the settings asset → `CometChatUIKit.login(uid)`. Fine for building; never for release.\n\n**Production (what you must move to):**\n1. Your **server** mints a per-user auth token by calling CometChat's REST API with the **REST API Key** (which stays on the server, never in the app).\n2. Your app authenticates the user your normal way, then asks YOUR backend for that token.\n3. The app signs in with the token:\n```dart\nimport 'package:cometchat_chat_uikit\u002Fcometchat_chat_uikit.dart';\n\nFuture\u003Cvoid> signIn(String authTokenFromYourServer) async {\n  await CometChatUIKit.loginWithAuthToken(\n    authTokenFromYourServer,\n    onSuccess: (User user) {},\n    onError: (CometChatException e) {},\n  );\n}\n```\n4. **Remove `credentials.authKey`** from the shipped settings file. Confirm by unzipping the release artifact and grepping for the key — do not take it on trust.\n> Fetch the exact token-minting endpoint from the REST API docs (`..\u002Fcometchat-flutter-v6-core\u002Freferences\u002Fdocs-map.md` → SDK\u002FREST). Never invent a URL or payload.\n\n## Session hygiene\n- **Log out properly** — `CometChatUIKit.logout()` on your app's sign-out, and unregister the push token FIRST (`-push`), or the next user of the device receives the previous user's notifications.\n- **One user per session.** `login` no-ops if that UID is already signed in, but switching users requires an explicit logout first.\n- **Token expiry** — a server-minted token can expire; handle the login error by refetching from your backend rather than falling back to the Auth Key.\n\n## Release build config\n- **Android** — `minSdk 26` (the docs' 24 is too low — the kit's `cometchat_calls_sdk` dependency pins 26); INTERNET permission; calling adds camera\u002Fmic. If you use R8\u002FProGuard, verify the kit still works in a **release** build, not just debug.\n- **iOS** — deployment target per the docs; usage-description strings for camera\u002Fmic\u002Fphotos, or the OS kills the app on first use.\n- **Settings asset** — a registered asset, so NOT gitignored (a fresh clone \u002F CI `flutter build` fails with *\"No file or variants found for asset\"*): commit a placeholder (no real Auth Key) and have CI overwrite it at build time with the prod-flavoured file (no Auth Key).\n- **Flavors** — dev and prod should point at different CometChat apps; do not test against production data.\n\n## Pre-ship checklist\n1. No Auth Key in the release artifact (verified by inspection, not assumption).\n2. `loginWithAuthToken` is the only login path in prod code.\n3. Logout clears the session **and** unregisters push.\n4. Permission strings present on both platforms.\n5. Release build (obfuscated) actually runs — chat renders, messages send.\n6. Tested against the prod CometChat app, on real devices.\n7. Errors surface to the user rather than being swallowed in an empty `onError`.\n\n## Common pitfalls (BAKED)\n- **Shipping the Auth Key** — the single most serious mistake here.\n- **Assuming `--dart-define` is a secret** — it is compiled into the binary, same exposure.\n- **Only testing debug builds** — obfuscation\u002Fminification problems appear only in release.\n- **No logout path** → the session persists across users on a shared device.\n- **Swallowing `onError`** → a production auth failure looks like a blank screen.\n- **Minting tokens in the app** — that needs the REST key, which must never be in the client.\n\n## Verify it works\nThe release artifact contains no Auth Key; sign-in goes through your backend; sign-out clears the session and push; a release build on a real device sends and receives; an expired token produces a clean re-auth rather than a blank screen.\n","> **Ground truth:** `loginWithAuthToken` and `logout` are catalog-verified against 6.1.0. Token MINTING is a server-side REST call — its exact endpoint is FETCHED from the REST API docs, never guessed. The dev-vs-prod credential rule is `RULES.md` §4.\n\n## Companion skills (read first)\n- `cometchat-flutter-v6-core` — install, credentials, `init→login→render`, `lifecycle.md`. This skill ASSUMES it.\n- `cometchat-flutter-v6-patterns` — where config comes from in your build pipeline.\n- `cometchat-security` — the enterprise auth model this client-side hardening plugs into: wiring your IdP \u002F SSO into the token flow (your IdP → your server → mint the CometChat auth token; CometChat is **not** an IdP), token expiry\u002Frefresh + re-login, RBAC roles + group (SBAC) scopes, and Auth Key vs auth token vs REST API Key. Load it for a security review or any SSO question.\n\n## Use this skill when\nHardening before release: \"is the Auth Key safe to ship\", \"set up production auth\", \"what do I check before shipping\".\n\n## Prerequisites & install\nCore done. No new package.\n\n## The one thing that actually matters: the Auth Key must not ship\nAn **Auth Key can log in as ANY user of your app.** Everything core writes for development puts it in `cometchat-settings.json`, which is bundled into the APK\u002FIPA — and a bundle is not a secret. Anyone can extract it.\n\n**Development (what core wired):** `credentials.authKey` in the settings asset → `CometChatUIKit.login(uid)`. Fine for building; never for release.\n\n**Production (what you must move to):**\n1. Your **server** mints a per-user auth token by calling CometChat's REST API with the **REST API Key** (which stays on the server, never in the app).\n2. Your app authenticates the user your normal way, then asks YOUR backend for that token.\n3. The app signs in with the token:\n```dart\nimport 'package:cometchat_chat_uikit\u002Fcometchat_chat_uikit.dart';\n\nFuture\u003Cvoid> signIn(String authTokenFromYourServer) async {\n  await CometChatUIKit.loginWithAuthToken(\n    authTokenFromYourServer,\n    onSuccess: (User user) {},\n    onError: (CometChatException e) {},\n  );\n}\n```\n4. **Remove `credentials.authKey`** from the shipped settings file. Confirm by unzipping the release artifact and grepping for the key — do not take it on trust.\n> Fetch the exact token-minting endpoint from the REST API docs (`..\u002Fcometchat-flutter-v6-core\u002Freferences\u002Fdocs-map.md` → SDK\u002FREST). Never invent a URL or payload.\n\n## Session hygiene\n- **Log out properly** — `CometChatUIKit.logout()` on your app's sign-out, and unregister the push token FIRST (`-push`), or the next user of the device receives the previous user's notifications.\n- **One user per session.** `login` no-ops if that UID is already signed in, but switching users requires an explicit logout first.\n- **Token expiry** — a server-minted token can expire; handle the login error by refetching from your backend rather than falling back to the Auth Key.\n\n## Release build config\n- **Android** — `minSdk 26` (the docs' 24 is too low — the kit's `cometchat_calls_sdk` dependency pins 26); INTERNET permission; calling adds camera\u002Fmic. If you use R8\u002FProGuard, verify the kit still works in a **release** build, not just debug.\n- **iOS** — deployment target per the docs; usage-description strings for camera\u002Fmic\u002Fphotos, or the OS kills the app on first use.\n- **Settings asset** — a registered asset, so NOT gitignored (a fresh clone \u002F CI `flutter build` fails with *\"No file or variants found for asset\"*): commit a placeholder (no real Auth Key) and have CI overwrite it at build time with the prod-flavoured file (no Auth Key).\n- **Flavors** — dev and prod should point at different CometChat apps; do not test against production data.\n\n## Pre-ship checklist\n1. No Auth Key in the release artifact (verified by inspection, not assumption).\n2. `loginWithAuthToken` is the only login path in prod code.\n3. Logout clears the session **and** unregisters push.\n4. Permission strings present on both platforms.\n5. Release build (obfuscated) actually runs — chat renders, messages send.\n6. Tested against the prod CometChat app, on real devices.\n7. Errors surface to the user rather than being swallowed in an empty `onError`.\n\n## Common pitfalls (BAKED)\n- **Shipping the Auth Key** — the single most serious mistake here.\n- **Assuming `--dart-define` is a secret** — it is compiled into the binary, same exposure.\n- **Only testing debug builds** — obfuscation\u002Fminification problems appear only in release.\n- **No logout path** → the session persists across users on a shared device.\n- **Swallowing `onError`** → a production auth failure looks like a blank screen.\n- **Minting tokens in the app** — that needs the REST key, which must never be in the client.\n\n## Verify it works\nThe release artifact contains no Auth Key; sign-in goes through your backend; sign-out clears the session and push; a release build on a real device sends and receives; an expired token produces a clean re-auth rather than a blank screen.\n",{"name":5,"license":15,"metadata":46,"description":7,"compatibility":50},{"tags":47,"author":48,"version":49},"cometchat flutter production auth-token security release v6","CometChat","1.0.0","Flutter >=3.38.9; cometchat_chat_uikit ^6.2.0 (6.2.x; catalog compiler-verified vs 6.1.0, source-checked vs 6.2.0); cometchat_sdk ^5.0.8","main","cebc3dce495d7eb80d3b1d5841f877a4a92e162d","plugins\u002Fcometchat\u002Fcometchat-skills\u002Fskills\u002Fcometchat-flutter-v6-production",491,"https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins","https:\u002F\u002Fhol.org\u002Fplugins\u002Fbest-codex-plugins","https:\u002F\u002Fgithub.com\u002Fhashgraph-online","https:\u002F\u002Fhol.org","Open-source standards and developer tools for interoperable AI agents: discovery, identity, communication, payments, privacy and security.","2026-11-14 14:06:13",{"source":8,"skillName":5,"commands":62,"prompt":72,"zipAvailable":73},[63,66,69],{"tool":64,"command":65},"npx","npx skills add hashgraph-online\u002Fawesome-codex-plugins --skill cometchat-flutter-v6-production",{"tool":67,"command":68},"bunx","bunx skills add hashgraph-online\u002Fawesome-codex-plugins --skill cometchat-flutter-v6-production",{"tool":70,"command":71},"pnpm","pnpm dlx skills add hashgraph-online\u002Fawesome-codex-plugins --skill cometchat-flutter-v6-production","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Fcometchat\u002Fcometchat-skills\u002Fskills\u002Fcometchat-flutter-v6-production\u002FSKILL.md",true,[],[76,85,92,99,126,150],{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":80,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":83,"publishedAt":84},"01M746ZWACVKMZ1BJXJZHYJSSX","migrate-to-e2e","Moves an existing Playwright, Cypress, Selenium, Appium, Detox, Maestro, or TesterArmy suite to e2e one slice at a time, with the old suite running beside the new one until each ported test is proven. Keeps a MIGRATION.md progress file so any later session resumes where the last stopped. Optionally plants a defect to show both suites catch it. Use for \u002Fmigrate-to-e2e, \"migrate our tests to e2e\", \"port these Maestro flows\", \"move our TesterArmy tests\", or when a project has an e2e config and an older suite still running.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Ftester-army\u002Fe2e\u002Fskills\u002Fmigrate-to-e2e\u002FSKILL.md",[],[],"2026-11-11 15:11:14",{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":80,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":91,"publishedAt":84},"01M746ZPTAX1Q0FBKAB1CYND7E","e2e","Writes, runs, and debugs end-to-end tests for web and mobile apps with e2e, the agentic test runner, which mixes agent.act goals with exact locator assertions on a Playwright browser or an iOS or Android device. Also drives a project's running app live over the e2e MCP server to look at a screen, check a UI change, take a screenshot or record a video, and try a locator; and runs bug bashes, parallel e2e explore runs with each bug proven by a repro test. Use when a project depends on e2e or has an e2e.config.ts, when asked for end-to-end, browser, mobile, or agentic UI tests, to check a change in the running app, to QA or bug bash an app or branch, or when an e2e run fails.","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Ftester-army\u002Fe2e\u002Fskills\u002Fe2e\u002FSKILL.md",[],[],{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":80,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":98,"publishedAt":84},"01M746ZJN784HVHMDP9MQGCSGG","create-verification-skill","Generate a project-local verify-\u003Capp> skill on top of e2e, so any coding agent can launch the app, check it is worth driving, exercise a feature the way a user does, keep evidence, and bug bash it. Writes the skill, a feature map with one explore charter per feature, and proves it once. Use for \u002Fcreate-verification-skill, \"make a verification skill for this repo\", or when a project has no scripted way to prove UI behavior.","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Ftester-army\u002Fe2e\u002Fskills\u002Fcreate-verification-skill\u002FSKILL.md",[],[],{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":80,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":41},"01M716A6ETNB9B1SQ3GXZC75VR","deja-search","deja-vu memory — search the user's past AI coding sessions with the deja CLI. Holds what they already settled and never wrote into the repo (naming rules, banned or already-tried tools, required checks before merge, preferred values, who owns what). Use before your first edit in a task, before you call a change done or ready to merge, before you recommend a tool, library, design or reviewer, before re-debugging an error that may already be solved, when they say 'didn't we fix this before', 'what did we decide about X' or 'I already have that', and before telling them something on this machine does not exist.","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Fvshulcz\u002Fdeja-vu\u002Fskills\u002Fdeja-search\u002FSKILL.md",[],[106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125],"search","deja search","never","error","ready","memory","re","decide","fix","design","debugging","when","you","done","reviewer","io","change","cli","merge","past",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":80,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":132,"publishedAt":41},"01M716A3J2W5SENSE9VGMXB375","deja-reflect","End-of-session reflection and memory curation with deja-vu. Review what was decided, what commands broke and what repaired them, and record durable project rules or decisions with deja remember so the next session starts with them.","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Fvshulcz\u002Fdeja-vu\u002Fskills\u002Fdeja-reflect\u002FSKILL.md",[],[133,134,135,121,136,137,138,139,140,141,142,143,144,145,111,146,147,27,148,149],"deja reflect","reflect","review","with","record","github","next","https","node","Rules","decisions","brew","remember","project rules","project","end","reflection",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":80,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":167,"publishedAt":41},"01M715T3RR4BAYSR57HPPTJ0PF","revid","Make, edit, export and post AI videos with Revid (revid.ai) through the Revid MCP server. Use whenever the user wants a short-form or long-form video made (from an idea, a script, a URL, an article, a PDF, a tweet, a product page, their own clips, or a song), wants to find what is going viral on TikTok, YouTube, Instagram or X before making something, wants to edit or re-export an existing Revid project, generate a standalone AI image or clip, make a series episode, or publish and schedule a finished video to connected social accounts. Covers setup (hosted MCP with OAuth, or an API key), the 36 tools, credits, polling and the rules for publishing. Routes to the more specific revid-* skills when one fits.","https:\u002F\u002Fgithub.com\u002Fhashgraph-online\u002Fawesome-codex-plugins\u002Fblob\u002Fmain\u002Fplugins\u002Ftmakersas\u002Frevid-skills\u002Fskills\u002Frevid\u002FSKILL.md",[156,161,164],{"categoryNo":157,"categoryName":158,"taxonomyType":159,"taxonomyTypeDesc":160},"01JBSEEDCAT000000000000016","图像与多媒体","SCENARIO","使用场景",{"categoryNo":162,"categoryName":163,"taxonomyType":159,"taxonomyTypeDesc":160},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":165,"categoryName":166,"taxonomyType":159,"taxonomyTypeDesc":160},"01JBSEEDCAT000000000000010","后端与接口",[152,168,169,170,171,172,173,147,174,112,175,176,177,178,117,179,180,181,182,183],"URL","Video","short-form","standalone","PDF","viral","tiktok","short","social","MCP","song","image","mcp server","schedule","api","publish"]