api-websocket

WebSocket exploitation — origin-bypass (CSWSH cross-site WebSocket hijacking), missing per-message auth, message-type confusion, msg-flood DoS, ws→wss downgrade, hidden RPC routes in the WS frame layer.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/api/websocket/SKILL.md

Quality

Content

80%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, concise WebSocket attack playbook with strong copy-paste examples, held back only by a reference-style structure that lacks explicit validation checkpoints and any progressive-disclosure file split.

Suggestions

Add a short ordered detection workflow with explicit verification checkpoints (e.g., confirm 101 upgrade, confirm per-message auth state) before enumerating bug classes.

Move per-protocol deep-dives (Socket.IO, STOMP, GraphQL-WS, SignalR) into a reference bundle file linked from the body to apply progressive disclosure.

Dimension	Reasoning	Score
Conciseness	Lean and efficient: assumes Claude knows what WebSockets are, with tactical prose and copy-paste code blocks where every line earns its place.	3 / 3
Actionability	Fully executable, copy-paste-ready guidance throughout — curl handshake test, wscat one-liners, a python websocket script, and an HTML CSWSH PoC.	3 / 3
Workflow Clarity	Content is organized as a per-bug-class reference with a Detect entry point, but there are no explicit validation/verification checkpoints or error-recovery feedback loops for the detection workflow.	2 / 3
Progressive Disclosure	A single ~100-line monolithic file with all protocol-specific and per-class detail inline; no bundle files or one-level-deep references to split the content, so it stays at 2 rather than 3.	2 / 3
	Total	10 / 12 Passed

Description

67%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-scoped description that clearly conveys the skill's WebSocket attack coverage, but it omits explicit "when to use" trigger guidance and is somewhat jargon-heavy.

Suggestions

Add a "Use when ..." clause naming natural triggers, e.g. testing WebSocket endpoints, finding CSWSH/origin-bypass, or auditing ws/wss connections.

Soften jargon (msg-flood, ws→wss) with plain-language equivalents so a user could naturally request the skill by saying them.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete bug classes — "origin-bypass (CSWSH...)", "missing per-message auth", "message-type confusion", "msg-flood DoS", "ws→wss downgrade", "hidden RPC routes" — rather than vague language.	3 / 3
Completeness	Clearly answers "what" (the bug classes covered) but has no "Use when..." clause or equivalent explicit trigger guidance for when Claude should invoke the skill, capping completeness at 2.	2 / 3
Trigger Term Quality	Includes natural terms ("WebSocket exploitation", "cross-site WebSocket hijacking") but leans heavily on jargon abbreviations (CSWSH, msg-flood, ws→wss) and omits common variations like "WebSocket testing/security/vulnerabilities".	2 / 3
Distinctiveness Conflict Risk	"WebSocket exploitation" scoped to these specific attack classes is a clear niche with distinct triggers, unlikely to fire for unrelated skills.	3 / 3
	Total	10 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/api/websocket/SKILL.md
Commit: e34afba

Reviewed: about 16 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.