testing-websocket-api-security
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data received from remote WebSocket endpoints through the
ws.recv()method inscripts/agent.pyandSKILL.mdsnippets.\n - Ingestion points: Server responses are captured during handshake analysis and injection testing in
scripts/agent.pyand code blocks inSKILL.md.\n - Boundary markers: The skill lacks explicit delimiters or instructions to ignore potentially malicious embedded content within the server's response data.\n
- Capability inventory: The agent script has the capability to establish network connections via
websocketsand write structured JSON data to the local file system usingjson.dump.\n - Sanitization: The skill does not sanitize or escape the content of WebSocket responses before including them in the final security report.
Audit Metadata