The Agent Skills Directory

[SAFE]: No malicious patterns or security risks were identified in the skill instructions or supporting documentation. The repository follows a clear structure for educating developers on WebSocket implementation.
[CREDENTIALS_UNSAFE]: The skill correctly demonstrates secure credential management by using environment variables (e.g., process.env.JWT_SECRET, process.env.REDIS_URL) in all code examples instead of hardcoding sensitive information.
[REMOTE_CODE_EXECUTION]: No remote code execution vulnerabilities were found. All external dependencies referenced in the examples are well-known, established libraries in the Node.js ecosystem.
[INDIRECT_PROMPT_INJECTION]: While the skill involves processing real-time data from users, it includes specific security guidance and code templates for XSS protection using sanitize-html and input validation using joi to mitigate these risks.
[COMMAND_EXECUTION]: The workflow mentions local testing with npx wscat, which is a standard developer tool for WebSocket debugging and is considered safe in this context.

websocket-engineer