exploiting-websocket-vulnerabilities
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes command-line utilities such as curl, wscat, and websocat to probe WebSocket endpoints and verify handshake behaviors.
- [EXTERNAL_DOWNLOADS]: The skill references the installation of legitimate security tools from trusted registries, including npm (wscat), Cargo (websocat), and PyPI (websockets, requests).
- [DATA_EXFILTRATION]: The skill includes an educational proof-of-concept for Cross-Site WebSocket Hijacking (CSWSH) that demonstrates how sensitive data could be exfiltrated to an external domain (attacker.example.com) if the vulnerability is present.
- [SAFE]: All security-sensitive actions, such as sending exploit payloads including path traversal or command injection strings, are clearly documented as part of an authorized vulnerability assessment workflow.
Audit Metadata