메뉴
Flag missing resource bounds / DoS resistance — uncapped loops or allocations, missing timeouts, reconciler-wedging input, unbounded metric cardinality (CWE-400, CWE-770).
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Build and manage a kind cluster for Workload-Aware Scheduling (WAS) e2e tests. Use when the user wants to set up, run tests against, or tear down a WAS test cluster built from Kubernetes main.
Flag solutions more elaborate than the problem requires — complexity that exists only because the author reached for a pattern.
Flag identical (or near-identical) blocks across types/adapters/call sites that should live in a shared helper — and newly extracted helpers with only one caller.
Flag code organization that a future maintainer will struggle to follow, modify, or extend.
Flag code put somewhere a reader would not expect to find it — cleanup scattered across callers, validation deep in business logic.
Flag unnecessary indirection, mismatched abstractions, or confusing data flow that obscures what the code is doing.
| name | resource-bounds-dos |
| description | Flag missing resource bounds / DoS resistance — uncapped loops or allocations, missing timeouts, reconciler-wedging input, unbounded metric cardinality (CWE-400, CWE-770). |
| license | Apache-2.0 |
| metadata | {"copyright":"The Kubernetes Authors"} |
PodSets, ResourceGroups, Flavors, cohort
children, admission checks) without a documented webhook-enforced cap or explicit
length check.make([]T, n) / make(map[K]V, n) where n comes from user data without a sanity
cap.context.WithTimeout (or a bounded inherited
reconcile context)..spec.interval-style fields that could wedge the reconciler for the entire
kind (CVE-2022-39272 pattern). Failures from invalid CR content must surface to
status, not crash-loop.workload_name, pod_name,
namespace+name composites, annotation values as labels.