Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →fenghot/websocket-test
WebSocket 安全测试。覆盖认证绕过（握手后换 token）、Cross-Site WebSocket Hijacking (CSWSH)、越权订阅（篡改 channel/room ID）、消息注入攻击、 WebSocket 重放攻击、连接耗尽 DoS。从 JS 中搜索 ws:// / wss:// / new WebSocket 定位端点。
Passed 14 of 22 test cases with the skill, and 10 of 22 without it.
and 1 more in the full report
4 fixed10 passed either way8 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
In the standardized audit output structure, what exact file path is used to record Cross-Site WebSocket Hijacking assessment outcomes?
| Checked | Without skill | With skill |
|---|---|---|
| Uses findings/ws_cswsh_results.md as the file path | Missed | Passed |
The instructions your model reads when the skill loads.
现代应用大量用 WebSocket 做实时通信（消息、通知、协作编辑、交易推送）。 JS 分析阶段搜索
new WebSocket(ws://wss://定位所有 WS 端点。
规则 1: 从 JS 中定位所有 WS 端点（new WebSocket / ws:// / wss://）
规则 2: 每个 WS 端点至少测试认证和越权
规则 3: WS 测试只用自己的测试账号
规则 4: 不允许批量接收/监听他人实时消息（限于证明越权原则 ≤5 条）
在 JS 文件中搜索:
□ new WebSocket( → 直接创建连接
□ io( → Socket.IO 客户端
□ ws:// → 明文连接（可中间人）
□ wss:// → 加密连接
□ socket.emit( → Socket.IO 发送事件
□ socket.on( → Socket.IO 接收事件
□ .subscribe( → STOMP/RxJS 订阅
□ Stomp.client( → STOMP over WebSocket
# 从 JS 文件中 grep WebSocket 连接
grep -rn "new WebSocket\|ws://\|wss://\|io(\|socket.emit\|\.subscribe\|Stomp" \
downloaded/${TARGET}/js/ > ws_endpoints_raw.txt
test cases passed, vs 10 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.