Agent skill · security · yaklang
websocket-security
WebSocket handshake, CSWSH, tooling (wsrepl, ws-harness, Burp), and common flaws. Use when apps use real-time channels, chat, notifications, or WS-backed APIs.
Why this skill is useful
Provides specific tooling commands and vulnerability patterns for WebSocket security that the AI wouldn't reliably generate on its own.
What it needs
Requires pip installed locally. About 7k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: WebSocket Security AI LOAD INSTRUCTION: This skill covers WebSocket protocol basics, cross-site WebSocket hijacking (CSWSH), practical tooling bridges, and common vulnerability classes. Apply only in authorized tests; treat tokens and message content as sensitive. For REST/GraphQL companion testing, cross-load api-sec when present in the workspace. 0. QUICK START During proxy or raw traffic review, watch for: Server success response indicators: Routing note: in Burp/browser DevTools, filter for 101 and Upgrade: websocket; for deeper API testing, align authn/authz models through api-sec. --- 1. PROTOCOL BASICS Client request (typical) Upgrade: websocket and Connection: Upgrade — required upgrade handshake. Sec-WebSocket-Key — base64 nonce; server hashes with magic GUID and responds with Sec-WebSocket-Accept. Sec-WebSocket-Version: 13 — current standard version for browser interoperability. Server response HTTP/1.1 101 Switching Protocols — handshake complete; subsequent frames are WebSocket binary/text frames per RFC. Minimal conceptual flow: --- 2. CROSS-SITE WEBSOCKET HIJACKING (CSWSH) Condition The server does not validate Origin (or equivalent binding) on the WebSocket handshake, and The victim has an active session (cookie-based or browser-stored creds) to the target site. Then a malicious page loaded in the victim’s browser may open a WebSocket as the victim, similar in spirit to CSRF but for a persistent bidirectional channel. Proof-of-concept pattern (laboratory / authorized target only) Testing notes: Confirm whether Origin is checked, whether cookies are sent (SameSite rules), and whether subprotocol or custom headers are required—missing checks increase CSWSH risk. --- 3. TESTING WITH TOOLS wsrepl Use a plugin to reproduce browser cookies, headers, or token refresh during the WebSocket lifecycle. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/websocket-security