websocket-engineer
Fail
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill references an external documentation URL (https://jeffallan.github.io/claude-skills/skills/api-architecture/websocket-engineer/) that is explicitly flagged as malicious by automated reputation scanners. Furthermore, it suggests using 'npx wscat', a tool that downloads and executes code from the NPM registry at runtime, which poses a significant risk when combined with references to malicious sources.\n- [EXTERNAL_DOWNLOADS]: The skill includes links to and instructions involving a third-party 'github.io' site belonging to an untrusted user. This domain and specific path have been identified as hosting malicious content according to URLite scanner alerts.\n- [METADATA_POISONING]: The skill file 'SKILL.md' was detected as malicious by file reputation scanners. Additionally, the author listed in the metadata (Jeffallan) differs from the expected developer context, suggesting a potential supply chain risk or impersonation attempt aimed at directing users to compromised documentation.\n- [INDIRECT_PROMPT_INJECTION]: The skill establishes patterns for real-time messaging that ingest untrusted data, creating a surface for indirect prompt injection.\n
- Ingestion points: Untrusted data enters the agent context via 'socket.on("message")' event handlers defined in 'SKILL.md' and 'references/security.md'.\n
- Boundary markers: The skill does not provide instructions to wrap incoming data in delimiters or to ignore embedded commands, which could allow malicious users to inject instructions into the agent's workflow.\n
- Capability inventory: The skill implementation demonstrates capabilities for Redis storage, message broadcasting, and logging, which could be abused if an injection occurs.\n
- Sanitization: Although 'references/security.md' lists sanitization libraries like 'sanitize-html', the primary implementation templates do not enforce or integrate these safeguards by default.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata