Websockets
Apply when implementing or reviewing real-time WebSocket features — connection auth, reconnection, event schema, room authorization. Active when standards.json features.realtime is true, or socket.io/ws/WebSocket is in the manifest AND used in source (`@WebSocketGateway`, `io()`, `new WebSocket()` — `ws` in the manifest alone proves nothing, many tools bundle it).
Install
$ agentstack add skill-pixelcrafts-app-agent-skills-websockets ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ● Network access Used
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
WebSockets
> Real-time connections are long-lived and trusted-by-default — close that gap. Principles are firm; the numbers are examples.
- Authenticate on the
connectionevent, not on first message. Unauthenticated →disconnect()immediately; an open unauthenticated socket is an info leak + resource drain. - Authorize every room join before
join()— never let clients join arbitrary rooms by name. - Reconnect with bounded exponential backoff (e.g. 1s→2s→4s, 3 tries) — immediate loops cause a thundering herd on outage. After max retries, show an explicit offline state; never retry forever.
- Event names live in a shared enum, never raw strings — renames break at compile time instead of silently.
- Version the event schema — an incompatible client must detect and stop, not misinterpret events.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: pixelcrafts-app
- Source: pixelcrafts-app/agent-skills
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.