Skills azure-messaging-webpubsub-java
📦

azure-messaging-webpubsub-java

Content revision r2 High Risk ⚙️ External commands🌐 Network access

Build Azure Web PubSub Apps with Java

Real-time Java applications need secure, targeted messaging across WebSocket clients. This skill provides Azure Web PubSub patterns for clients, groups, tokens, permissions, async operations, and errors.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "azure-messaging-webpubsub-java" from https://skillstore.io/skills/sickn33-azure-messaging-webpubsub-java.md and its manifest at https://skillstore.io/api/skills/sickn33-azure-messaging-webpubsub-java/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Test it

Using "azure-messaging-webpubsub-java". Send release updates to premium users without broadcasting to every connection.

Expected outcome:

Recommended approach: place authorized connections in a premium-users group, send updates to that group, and handle service errors explicitly.

Using "azure-messaging-webpubsub-java". Create browser access for one user who can send messages only to the support group.

Expected outcome:

Use a short-lived token with the authenticated user identity and a support-group send role. Never print the token URL.

Using "azure-messaging-webpubsub-java". Explain how an asynchronous group send should report success and failure.

Expected outcome:

Subscribe to the async result, record a non-secret success event, and route failures through structured error handling.

Security Audit

High Risk
v5 • 7/23/2026 Open versioned report

All 37 external-command findings are false positives caused by Markdown fences or inline role names. The two URL findings are placeholder Azure endpoints, not outbound requests. The review found token URL logging and unscoped group roles in examples.

1
Files scanned
313
Lines analyzed
0
Review items
0
False positives ignored

Confirmed security concerns (2)

High
Client Access Token URL Logged
The token example prints token.getUrl() to standard output. A client access URL can carry bearer credentials, so application logs may expose Web PubSub access.
The example directly prints the URL returned for a newly generated client access token. Token-bearing URLs are authentication material and should not enter logs.
Medium
Unscoped Group Roles Granted
The token example grants join and send roles without a group suffix. The role table states that these roles apply to any group.
The example and role table explicitly show unscoped permissions and their any-group effect. The skill also documents group-scoped alternatives.
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/sickn33-azure-messaging-webpubsub-java/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-azure-messaging-webpubsub-java/security.svg)](https://skillstore.io/skills/sickn33-azure-messaging-webpubsub-java?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-azure-messaging-webpubsub-java?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-azure-messaging-webpubsub-java/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-azure-messaging-webpubsub-java.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). azure-messaging-webpubsub-java security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-azure-messaging-webpubsub-java/audits/5

BibTeX citation

@techreport{sickn33-sickn33-azure-messaging-webpubsub-java-2026, author = {sickn33}, title = {azure-messaging-webpubsub-java security audit report (audit version 5)}, institution = {Skillstore}, year = {2026}, number = {5}, url = {https://skillstore.io/skills/sickn33-azure-messaging-webpubsub-java/audits/5}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "azure-messaging-webpubsub-java security audit report (audit version 5)" version: "unspecified" type: report authors: - name: "sickn33" date-released: "2026-07-23" url: "https://skillstore.io/skills/sickn33-azure-messaging-webpubsub-java/audits/5" identifiers: - type: other value: "skillstore:sickn33-azure-messaging-webpubsub-java:audit:5" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
68
Community
83
Spec Compliance

What You Can Build

Add targeted application updates

Create Java service code that sends authorized notifications to selected users, connections, or groups.

Standardize messaging integration

Define consistent client creation, authentication, async handling, and connection management patterns across services.

Review token permissions

Evaluate access token roles, expiration, group scope, and permission grants before production release.

Try These Prompts

Create a service client
Show me how to create an Azure Web PubSub Java service client with DefaultAzureCredential for hub {hub_name}.
Send group updates
Design Java code that sends {message_type} updates to group {group_name}. Include error handling and explain each required SDK type.
Issue a scoped token
Create a short-lived token for user {user_id} that can only send to group {group_name}. Avoid broad roles and secret logging.
Review a production design
Review this Azure Web PubSub Java design: {design}. Identify authorization, token handling, filtering, async, and connection lifecycle risks. Propose safer patterns.

Best Practices

  • Use DefaultAzureCredential when possible, and keep connection strings or access keys outside source control.
  • Grant group-scoped roles with short token lifetimes and authenticated user identities.
  • Validate recipients, handle HTTP failures, and test disconnect behavior before production deployment.

Avoid

  • Do not print token URLs, connection strings, access keys, or full authentication errors.
  • Do not grant unscoped send or join roles when one group is sufficient.
  • Do not broadcast user-controlled content without authorization, validation, and rate controls.

Frequently Asked Questions

What does this skill cover?
It covers Java service clients, message delivery, groups, connections, client tokens, permissions, async operations, and basic error handling.
Does this skill deploy Azure resources?
No. You need an existing Azure Web PubSub resource and valid credentials.
Which authentication methods are shown?
The examples include connection strings, AzureKeyCredential, and DefaultAzureCredential.
Does it support synchronous and asynchronous clients?
Yes. It documents both client types and shows asynchronous success and error callbacks.
Can it help create client access tokens?
Yes. It explains user identities, roles, initial groups, and expiration settings. Treat every generated token as a secret.
Are the examples production ready?
No. Validate authorization, secret handling, retry behavior, observability, SDK versions, and load characteristics for your environment.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Ref

f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526

Maintenance freshness

7/26/2026

Usage

8 downloads · 91 views

File structure

📄 SKILL.md