feat(skills): add WebSocket security testing skill

[sandiyochristan]

No description provided.

[greptile-apps]

Greptile Summary

Adds a standalone WebSocket security-testing skill covering discovery, handshake and message authorization, injection, framework-specific attacks, transport behavior, denial of service, validation, and false-positive guidance.

• Documents native WebSocket, Socket.IO, GraphQL subscription, SignalR, and ActionCable testing.
• Adds concrete reconnaissance probes, payloads, authorization tests, and evidence expectations.
• Includes unsafe unbounded denial-of-service instructions and incomplete validation guidance for token leakage and malformed-frame behavior.

Confidence Score: 3/5

This PR should not merge until the WebSocket denial-of-service procedures are bounded with staged rates, minimal-impact validation, and explicit stop conditions.

The new skill is operational guidance consumed directly by autonomous agents and currently directs maximum connection use and flooding without a global or local safety bound; its token-leakage and malformed-frame sections also need clearer evidence requirements.

Files Needing Attention: strix/skills/protocols/websocket.md

Security Review

The denial-of-service section directs autonomous agents to maximize connections and flood in-scope targets without proactive limits or stop conditions, creating a realistic service-disruption path.

Important Files Changed

Filename	Overview
strix/skills/protocols/websocket.md	Adds broad WebSocket testing guidance, but its unbounded destructive-load instructions can disrupt targets and several test classes lack sufficient evidence and false-positive criteria.

Prompt To Fix All With AI

### Issue 1
strix/skills/protocols/websocket.md:137-147
**Unbounded denial-of-service testing**

When an autonomous agent follows these instructions against an authorized production or shared target, it opens maximum connections and floods resource-intensive payloads without staged limits or stop conditions, causing connection, memory, CPU, or bandwidth exhaustion that can disrupt the service. Add conservative initial limits, explicit escalation criteria, and immediate stop conditions. **How this was verified:** The skill is loaded verbatim as operational guidance, and neither it nor the global agent prompt places a proactive bound on destructive load.

### Issue 2
strix/skills/protocols/websocket.md:88-89
**Unverified query-token leakage claim**

This treats every query-string token as leaking through Referer, logs, proxies, and browser history without requiring an attacker-observable sink. Require evidence of an actual exposure channel, such as a third-party Referer under the active policy or accessible log entry, to prevent false-positive credential-leakage findings and unsupported remediation.

### Issue 3
strix/skills/protocols/websocket.md:191-196
**Missing protocol-rejection validation**

The skill recommends malformed frames, reserved opcodes, and incomplete fragments but never explains that a compliant protocol error or disconnect is expected behavior. Require demonstrated cross-connection impact, persistent degradation, inspection bypass, or another concrete consequence so normal RFC-compliant rejection is not reported as a frame-abuse or denial-of-service vulnerability.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "feat(skills): add WebSocket security tes..." | Re-trigger Greptile}

[greptile-apps]

Unbounded denial-of-service testing

When an autonomous agent follows these instructions against an authorized production or shared target, it opens maximum connections and floods resource-intensive payloads without staged limits or stop conditions, causing connection, memory, CPU, or bandwidth exhaustion that can disrupt the service. Add conservative initial limits, explicit escalation criteria, and immediate stop conditions. How this was verified: The skill is loaded verbatim as operational guidance, and neither it nor the global agent prompt places a proactive bound on destructive load.

Knowledge Base Used: Skills Library

Prompt To Fix With AI

This is a comment left during a code review.
Path: strix/skills/protocols/websocket.md
Line: 137-147

Comment:
**Unbounded denial-of-service testing**

When an autonomous agent follows these instructions against an authorized production or shared target, it opens maximum connections and floods resource-intensive payloads without staged limits or stop conditions, causing connection, memory, CPU, or bandwidth exhaustion that can disrupt the service. Add conservative initial limits, explicit escalation criteria, and immediate stop conditions. **How this was verified:** The skill is loaded verbatim as operational guidance, and neither it nor the global agent prompt places a proactive bound on destructive load.

**Knowledge Base Used:** [Skills Library](https://app.greptile.com/strix-org-3/-/custom-context/knowledge-base/usestrix/strix/-/docs/skills-library.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Unverified query-token leakage claim

This treats every query-string token as leaking through Referer, logs, proxies, and browser history without requiring an attacker-observable sink. Require evidence of an actual exposure channel, such as a third-party Referer under the active policy or accessible log entry, to prevent false-positive credential-leakage findings and unsupported remediation.

Knowledge Base Used: Skills Library

Prompt To Fix With AI

This is a comment left during a code review.
Path: strix/skills/protocols/websocket.md
Line: 88-89

Comment:
**Unverified query-token leakage claim**

This treats every query-string token as leaking through Referer, logs, proxies, and browser history without requiring an attacker-observable sink. Require evidence of an actual exposure channel, such as a third-party Referer under the active policy or accessible log entry, to prevent false-positive credential-leakage findings and unsupported remediation.

**Knowledge Base Used:** [Skills Library](https://app.greptile.com/strix-org-3/-/custom-context/knowledge-base/usestrix/strix/-/docs/skills-library.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[greptile-apps]

Missing protocol-rejection validation

The skill recommends malformed frames, reserved opcodes, and incomplete fragments but never explains that a compliant protocol error or disconnect is expected behavior. Require demonstrated cross-connection impact, persistent degradation, inspection bypass, or another concrete consequence so normal RFC-compliant rejection is not reported as a frame-abuse or denial-of-service vulnerability.

Knowledge Base Used: Skills Library

Prompt To Fix With AI

This is a comment left during a code review.
Path: strix/skills/protocols/websocket.md
Line: 191-196

Comment:
**Missing protocol-rejection validation**

The skill recommends malformed frames, reserved opcodes, and incomplete fragments but never explains that a compliant protocol error or disconnect is expected behavior. Require demonstrated cross-connection impact, persistent degradation, inspection bypass, or another concrete consequence so normal RFC-compliant rejection is not reported as a frame-abuse or denial-of-service vulnerability.

**Knowledge Base Used:** [Skills Library](https://app.greptile.com/strix-org-3/-/custom-context/knowledge-base/usestrix/strix/-/docs/skills-library.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!