chatkit-widget
Facilitates seamless integration of OpenAI/ChatKit chat widgets into Next.js/React applications with customizable branding and secure access.
Install this skill
or
71/100
Security score
The chatkit-widget skill was audited on Feb 28, 2026 and we found 13 security issues across 3 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
medium line 206
Template literal with variable interpolation in command context
SourceSKILL.md
| 206 | script.src = `${chatkitConfig.apiUrl}/widget.js`; |
medium line 322
Template literal with variable interpolation in command context
SourceSKILL.md
| 322 | <style jsx global>{` |
medium line 424
Template literal with variable interpolation in command context
SourceSKILL.md
| 424 | const response = await fetch(`${CHATKIT_API_URL}${endpoint}`, { |
medium line 428
Template literal with variable interpolation in command context
SourceSKILL.md
| 428 | Authorization: `Bearer ${CHATKIT_SECRET}`, |
low line 94
Access to .env file
SourceSKILL.md
| 94 | projectId: process.env.NEXT_PUBLIC_CHATKIT_PROJECT_ID || "", |
low line 95
Access to .env file
SourceSKILL.md
| 95 | publicKey: process.env.NEXT_PUBLIC_CHATKIT_PUBLIC_KEY || "", |
low line 98
Access to .env file
SourceSKILL.md
| 98 | apiUrl: process.env.CHATKIT_API_URL || "https://api.chatkit.com", |
low line 138
Access to .env file
SourceSKILL.md
| 138 | # .env.example |
low line 397
Access to .env file
SourceSKILL.md
| 397 | const CHATKIT_SECRET = process.env.CHATKIT_SECRET_KEY; |
low line 398
Access to .env file
SourceSKILL.md
| 398 | const CHATKIT_API_URL = process.env.CHATKIT_API_URL || "https://api.chatkit.com/v2"; |
low line 98
External URL reference
SourceSKILL.md
| 98 | apiUrl: process.env.CHATKIT_API_URL || "https://api.chatkit.com", |
low line 146
External URL reference
SourceSKILL.md
| 146 | CHATKIT_API_URL="https://api.chatkit.com/v2" |
low line 398
External URL reference
SourceSKILL.md
| 398 | const CHATKIT_API_URL = process.env.CHATKIT_API_URL || "https://api.chatkit.com/v2"; |
Scanned on Feb 28, 2026
View Security Dashboard