The Agent Skills Directory

[SAFE]: The skill implements standard real-time communication patterns and provides proactive security guidance for production environments. It includes specific code for validating the Origin header to mitigate hijacking risks and demonstrates how to perform authentication and authorization before upgrading to a WebSocket protocol.
[INDIRECT_PROMPT_INJECTION]: The skill documents how to receive and broadcast external messages through WebSocket streams. While this constitutes an ingestion point for untrusted data, the examples include mitigations such as structured JSON parsing and maximum message size configurations. This represents a low-risk architectural surface inherent to the protocol being implemented.
Ingestion points: External data enters the system via ws.recv() and ws_rx.next() calls in SKILL.md.
Boundary markers: The skill demonstrates the use of structured JSON messages with serde to maintain data boundaries, though raw text handling is also shown for simplicity.
Capability inventory: The skill uses network sending capabilities (ws.send()) to respond to or broadcast messages.
Sanitization: The skill provides examples of decoding text into structured enums using serde_json, which effectively validates the schema of the incoming data.

salvo-websocket