Skills streaming-api-patterns
📦

streaming-api-patterns

v1.0.0 Content revision r2 Medium Risk ⚙️ External commands🌐 Network access

Build Reliable Streaming APIs

Real-time APIs often fail under disconnects, slow consumers, and malformed stream handling. This skill provides focused SSE, WebSocket, ReadableStream, and LLM streaming patterns.

Supports: Claude Codex Code(CC)
📊 71 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "streaming-api-patterns" from https://skillstore.io/skills/ariegoldkin-streaming-api-patterns.md and its manifest at https://skillstore.io/api/skills/ariegoldkin-streaming-api-patterns/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/ariegoldkin-streaming-api-patterns.md Signed manifest GET /api/skills/ariegoldkin-streaming-api-patterns/manifest Signed lockfile GET /api/skills/ariegoldkin-streaming-api-patterns/lockfile

Test it

Using "streaming-api-patterns". Choose a transport for one-way AI response tokens in a browser.

Expected outcome:

  • Recommendation: Server-Sent Events over a streamed HTTP response.
  • Reasons: One-way delivery matches the workload, browser support is broad, and reconnection behavior is predictable.
  • Implementation notes: Disable proxy buffering, handle cancellation, and measure time to first token.

Using "streaming-api-patterns". Review an SSE endpoint that exposes raw exceptions and never handles disconnects.

Expected outcome:

  • Priority finding: Replace internal exception text with a stable public error event.
  • Reliability finding: Stop upstream work when the request signal reports cancellation.
  • Verification: Test newline errors, early disconnects, slow clients, and proxy buffering.

Using "streaming-api-patterns". Plan a WebSocket chat service for many authenticated users.

Expected outcome:

  • Connection controls: Authenticate upgrades, validate origins, and authorize channel membership.
  • Message controls: Validate schemas, limit sizes, apply rate limits, and reject unexpected message types.
  • Operations: Add heartbeats, bounded queues, reconnect jitter, connection metrics, and load tests.

Security Audit

Medium Risk
v9 • 7/23/2026 Open versioned report

Static command findings are false positives caused by Markdown fences and TypeScript template literals; no shell execution exists. Network calls are expected examples for a streaming API skill and use local, relative, or standards documentation URLs. Two separate medium-risk example defects remain: unescaped error serialization and an unauthenticated, unvalidated WebSocket broadcast.

3
Files scanned
420
Lines analyzed
0
Review items
0
False positives ignored

Confirmed security concerns (2)

Medium
templates/sse-endpoint-template.ts:34-37
Unsafe SSE Error Serialization and Disclosure
The template inserts error.message directly into quoted JSON and sends it to clients. Quotes or newlines can corrupt framing, and internal details may leak.
Line 36 directly interpolates error.message without JSON.stringify or a public error mapping. The surrounding catch sends it over SSE.
Medium
SKILL.md:76-86
Unprotected WebSocket Broadcast Example
The server forwards every incoming message to all connected clients without authentication, authorization, origin checks, schema validation, or size limits.
The handler broadcasts raw data immediately. Later checklist guidance mentions safeguards, but the runnable example does not implement them.

Risk Factors

⚙️ External commands (13)
SKILL.md:29-66 SKILL.md:66-72 SKILL.md:72-93 SKILL.md:93-99 SKILL.md:99-103 SKILL.md:103-115 SKILL.md:115-119 SKILL.md:119-142 SKILL.md:142-187 SKILL.md:187-191 SKILL.md:191-222 templates/sse-endpoint-template.ts:25 templates/sse-endpoint-template.ts:36
🌐 Network access (9)
SKILL.md:160 SKILL.md:90 SKILL.md:62 SKILL.md:202 SKILL.md:255 SKILL.md:256 SKILL.md:257 SKILL.md:258 templates/sse-endpoint-template.ts:59
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/ariegoldkin-streaming-api-patterns/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/ariegoldkin-streaming-api-patterns/security.svg)](https://skillstore.io/skills/ariegoldkin-streaming-api-patterns?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/ariegoldkin-streaming-api-patterns?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/ariegoldkin-streaming-api-patterns/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/ariegoldkin-streaming-api-patterns.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

AI Agent Hub. (2026). streaming-api-patterns security audit report (audit version 9) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/ariegoldkin-streaming-api-patterns/audits/9

BibTeX citation

@techreport{ai-agent-hub-ariegoldkin-streaming-api-patterns-2026, author = {AI Agent Hub}, title = {streaming-api-patterns security audit report (audit version 9)}, institution = {Skillstore}, year = {2026}, number = {9}, url = {https://skillstore.io/skills/ariegoldkin-streaming-api-patterns/audits/9}, note = {Author version 1.0.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "streaming-api-patterns security audit report (audit version 9)" version: "1.0.0" type: report authors: - name: "AI Agent Hub" date-released: "2026-07-23" url: "https://skillstore.io/skills/ariegoldkin-streaming-api-patterns/audits/9" identifiers: - type: other value: "skillstore:ariegoldkin-streaming-api-patterns:audit:9" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High
55
Architecture
100
Maintainability
87
Content
71
Community
83
Spec Compliance

What You Can Build

Stream LLM Responses

Design a browser experience that displays model output as tokens arrive and handles cancellation or interruption.

Deliver Live Product Updates

Select and implement a transport for notifications, progress events, dashboards, or collaborative features.

Review Streaming Readiness

Evaluate a streaming design for reconnection, backpressure, security controls, proxy behavior, and operational testing.

Try These Prompts

Choose a Streaming Transport 
Compare SSE, WebSockets, and ReadableStream for [feature]. Recommend one based on direction, browser support, reconnection, and expected message frequency.
Design an SSE Endpoint 
Design a TypeScript SSE endpoint for [framework] that streams [data]. Include headers, cancellation, keepalives, structured events, and safe error handling.
Build a Resilient Client 
Create a resilient client for [stream URL]. Include exponential backoff, jitter, connection state, partial-frame parsing, cancellation, and observable error reporting.
Review Production Architecture 
Review this streaming architecture for [traffic profile] and [deployment platform]. Address authentication, authorization, backpressure, proxy buffering, rate limits, load testing, and monitoring.

Best Practices

  • Validate authentication, authorization, origins, message schemas, and payload sizes before opening or using a streaming connection.
  • Handle cancellation, timeouts, backpressure, and reconnection as core behavior rather than optional error paths.
  • Test partial frames, slow consumers, proxy buffering, long connections, concurrent clients, and controlled service failures.

Avoid

  • Do not broadcast unvalidated client messages or trust a connection solely because its transport succeeded.
  • Do not expose internal exception messages or build structured stream events through string interpolation.
  • Do not assume each network chunk contains a complete SSE event or valid text boundary.

Frequently Asked Questions

What does this skill cover?
It covers SSE, WebSockets, ReadableStream, LLM response streaming, reconnection, backpressure, performance, security checks, and testing.
When should I choose SSE?
Choose SSE for one-way server updates such as model tokens, notifications, progress events, or live feeds.
When should I choose WebSockets?
Choose WebSockets when clients and servers both need frequent, low-latency messages, such as chat or collaborative editing.
Are the examples production ready?
No. They are reference patterns that require authentication, authorization, validation, rate limits, monitoring, deployment checks, and stronger error handling.
Can Claude, Codex, and Claude Code use this skill?
Yes. Each supported assistant can apply the guidance while designing, implementing, or reviewing streaming code.
Does the skill handle backpressure and reconnection?
It outlines backpressure checks and demonstrates EventSource reconnection with exponential delay. Production systems still need load testing and platform-specific tuning.

Developer Details

License

MIT

Author version

v1.0.0

Skillstore revision

r2

Repository

https://github.com/ArieGoldkin/ai-agent-hub/tree/main/skills/streaming-api-patterns

Ref

89edfdc710d0846129dcee6a929477b04f08052c

Maintenance freshness

7/24/2026

Usage

7 downloads · 278 views

File structure

📁 checklists/

📄 streaming-checklist.md

📄 SKILL.md

📁 templates/

📄 sse-endpoint-template.ts