websocket-engineer
An agent skill by Jeffallan, from Jeffallan/claude-skills. Tags: api, debugging, scalability, slack, web.
What it does
Use when building real-time communication systems with WebSockets or Socket.IO. Invoke for bidirectional messaging, horizontal scaling with Redis, presence tracking, room management.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add Jeffallan/claude-skills --skill websocket-engineerOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/Jeffallan/claude-skills
cp -r claude-skills/skills/websocket-engineer ~/.claude/skills/websocket-engineerSafety box score
Grade C, moderate risk: 28 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill is implementation guidance for real-time WebSocket/Socket.IO systems, including auth, Redis pub/sub scaling, room management, and presence tracking. The main risks are that it touches sensitive session material, opens network connections to WebSocket/Redis endpoints, and can automatically broadcast messages and presence updates across many clients.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 1 (low) | It includes runnable examples and a local test command, e.g. `npx wscat -c ws://localhost:3000`, but no shipped scripts, installers, or `eval`/`curl | sh` patterns. |
| Network access | 2 (moderate) | The examples create live WebSocket and Redis connections, such as `const pubClient = createClient({ url: process.env.REDIS_URL });` and `const io = new Server(httpServer, { cors: { origin: process.env.ALLOWED_ORIGIN } });`, so using it reaches external network services. |
| Filesystem reach | 0 (none) | The skill does not read, write, or delete files outside the project; the only file output shown is local logging like `websocket-audit.log` in example code. |
| Secrets & credentials | 2 (moderate) | It explicitly handles auth secrets and session material, including `socket.handshake.auth.token`, `process.env.JWT_SECRET`, `process.env.COOKIE_SECRET`, and `socket.request.signedCookies.sessionId`. |
| Privilege & persistence | 0 (none) | There is no use of sudo, global installs, services, scheduled tasks, or shell/OS settings changes. |
| Instruction hijack surface | 0 (none) | I did not find prompt-skipping, hidden instructions, or calls to follow remote instructions; the markdown is ordinary implementation guidance. |
| Irreversible actions | 2 (moderate) | It automates delivery of messages and presence updates to rooms/users, for example `io.to(roomId).emit("message", ...)` and `sendMessage(userId, message)`, which can fan out data without another human check. |
| Transparency | 0 (none) | All shipped content is readable markdown with code snippets; there are no binaries, packed blobs, or decoded-at-runtime payloads. |
Before installing
- Read `references/security.md` first to confirm how JWTs, cookies, and `COOKIE_SECRET`/`JWT_SECRET` will be handled.
- If you will use the examples, point them only at a scratch WebSocket/Redis environment before any production endpoint.
- Check whether your app should really allow room-wide broadcasts and queued message delivery, since those are built into the patterns here.
- Verify that no browser cookies or signed sessions from your main account will be exposed to the agent-run workflow.
Rated 2026-10-20 by an automated review of 6 files from the skill's repository.
Source
- Repository
- Jeffallan/claude-skills (all skills from this repository)
- Path
- skills/websocket-engineer/SKILL.md
- Branch
- main
- Updated
- 2026-09-19
Related skills
- django-expert — Use when building Django web applications or REST APIs with Django REST Framework.
- java-architect — Use when building, configuring, or debugging enterprise Java applications with Spring Boot 3.x, microservices.
- secure-code-guardian — Use when implementing authentication/authorization, securing user input.
- debugging-and-error-recovery — Guides systematic root-cause debugging.
- last30days — Research what people actually say about any topic in the last 30 days.
- observability-and-instrumentation — Instruments code so production behavior is visible and diagnosable. Use when adding logging, metrics, tracing, or alerting.