OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Warn5 providerslatest audit Apr 16, 2026
Independent checks from skills.sh's audit partners.
The skill provides reference implementations for WebSocket servers and clients in Node.js and Python. While functional, the templates contain insecure configurations such as permissive CORS policies and verbose error reporting that could lead to information disclosure. Additionally, the skill establishes a vulnerability surface for indirect prompt injection by processing untrusted external messages without providing sanitization or validation logic.
Detected behaviors
No alerts
No issues
2/10 files flagged
Score: 93/100 · 2 sections analyzed