菜单
Flag injection vectors from user-supplied strings — exec, SSRF, fmt.Sprintf-built selectors/URLs, template rendering, query concatenation (CWE-78, CWE-94, CWE-918).
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Build and manage a kind cluster for Workload-Aware Scheduling (WAS) e2e tests. Use when the user wants to set up, run tests against, or tear down a WAS test cluster built from Kubernetes main.
Flag solutions more elaborate than the problem requires — complexity that exists only because the author reached for a pattern.
Flag identical (or near-identical) blocks across types/adapters/call sites that should live in a shared helper — and newly extracted helpers with only one caller.
Flag code organization that a future maintainer will struggle to follow, modify, or extend.
Flag code put somewhere a reader would not expect to find it — cleanup scattered across callers, validation deep in business logic.
Flag unnecessary indirection, mismatched abstractions, or confusing data flow that obscures what the code is doing.
| name | injection |
| description | Flag injection vectors from user-supplied strings — exec, SSRF, fmt.Sprintf-built selectors/URLs, template rendering, query concatenation (CWE-78, CWE-94, CWE-918). |
| license | Apache-2.0 |
| metadata | {"copyright":"The Kubernetes Authors"} |
os/exec / exec.Command with user-controlled arguments (CWE-78, CWE-94).http.Get / http.NewRequest to URLs built from CR fields (CWE-918 SSRF).
Container image refs, init-container pull specs, and webhook target URLs count as
untrusted.fmt.Sprintf building YAML, JSON, label selectors, field paths, or API server URLs
from user input. Require typed marshalling and labels.SelectorFromSet.