websocket-engineer
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill incorporates security best practices by demonstrating the implementation of authentication middleware using JWT and recommending the use of environment variables for sensitive data such as JWT secrets and database connection strings.
- [EXTERNAL_DOWNLOADS]: The implementation workflow references the use of 'wscat' via 'npx' for local connection validation and includes links to external documentation hosted on GitHub Pages.
- [PROMPT_INJECTION]: The skill defines a surface for indirect prompt injection by processing external data from socket events.
- Ingestion points: Data enters the context through 'roomId' and 'text' fields in the socket event handlers in SKILL.md.
- Boundary markers: The provided code examples do not demonstrate the use of delimiters for incoming messages.
- Capability inventory: The skill provides functionality for broadcasting messages to rooms and managing user presence across server instances.
- Sanitization: No specific input sanitization or validation logic is included in the basic code templates.
Audit Metadata