The Agent Skills Directory

[COMMAND_EXECUTION]: The skill suggests using npx wscat for local validation of WebSocket connections. This is a standard developer tool for testing and does not pose a security risk in this context.
[EXTERNAL_DOWNLOADS]: The skill references several well-known and trusted Node.js packages (e.g., socket.io, redis, jsonwebtoken, express, joi, sanitize-html). These are standard dependencies for the described functionality.
[DATA_EXFILTRATION]: No data exfiltration patterns were detected. The code examples correctly demonstrate using environment variables (e.g., process.env.JWT_SECRET, process.env.REDIS_URL) for managing sensitive credentials.
[INDIRECT_PROMPT_INJECTION]: While the skill implements patterns for processing external data (WebSocket messages), it includes explicit documentation and code examples for input validation and XSS protection using libraries like Joi and sanitize-html, effectively mitigating risks associated with untrusted data ingestion.

websocket-engineer