Websocket Hub Patterns

PassAudited by ClawScan on May 1, 2026.

Overview

The provided artifacts show a coherent instruction-only WebSocket/Redis pattern, with only a supply-chain note about user-run install commands from unpinned remote sources.

This appears safe to use as a WebSocket/Redis design reference. Before running any npx install command, verify the source and consider pinning the exact version or commit. If you implement the Redis registry examples, avoid storing sensitive connection details unless Redis access, retention, and encryption are properly controlled.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Running the install command could retrieve content different from what was reviewed if the upstream branch changes.

Why it was flagged

The README suggests a user-directed install from a moving GitHub branch via npx. This is not hidden or automatic, but the fetched content could change over time unless the source is pinned or verified.

Skill content

npx add https://github.com/wpank/ai/tree/main/skills/realtime/websocket-hub-patterns

Recommendation

Prefer the registry install path when appropriate, or pin and review the GitHub source before running npx-based installation commands.