The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill recommends using npx wscat as part of its core workflow for local validation of WebSocket servers. This command utilizes the npx package runner to fetch and execute the wscat utility from the npm registry.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection by design, as its primary purpose is handling real-time, user-provided message streams.
Ingestion points: Data enters the system via WebSocket events defined in SKILL.md (socket.on("message")) and in patterns described in references/patterns.md.
Boundary markers: The instructions do not define specific delimiters for separating user-provided message content from agent instructions in the output templates.
Capability inventory: The skill provides structural guidance rather than executing code directly; it contains no dangerous subprocesses, automated network exfiltration, or unauthorized file system access in its own definition.
Sanitization: The references/security.md documentation provides comprehensive mitigation strategies, including input validation via the Joi library and XSS protection through the sanitize-html package.
[METADATA_POISONING]: A discrepancy exists between the author name provided in the system metadata and the author metadata in the SKILL.md file, which references a specific GitHub profile. This indicates the skill is likely a template or derived from an external technical resource.

websocket-engineer