websocket-builder
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides best-practice architectural guidance for WebSocket implementations.\n
- Authentication Best Practices: Correctly instructs the agent to perform authentication during the HTTP handshake phase before upgrading to a WebSocket connection, preventing resource exhaustion from unauthenticated clients.\n
- Input Validation: Explicitly warns the agent to never trust client input and to validate every message against an expected schema.\n
- Availability and Resource Management: Recommends implementing ping/pong heartbeats, maximum message size limits, and connection limits per user to prevent denial-of-service (DoS) scenarios.\n
- Scaling Safety: Recommends standard Redis pub/sub patterns for horizontal scaling across multiple servers.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user prompts requesting WebSocket server setups. While this is an ingestion surface for untrusted data, the skill includes explicit instructions for input validation and schema enforcement which mitigates typical injection risks. The architectural nature of the skill does not grant elevated privileges or perform unsafe operations on user data.
Audit Metadata