# Injection

> Injection is an Agent Skill for devops & security published in the kubernetes-sigs/kueue repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Flag injection vectors from user-supplied strings — exec, SSRF, fmt.Sprintf-built selectors/URLs, template rendering, query concatenation (CWE-78, CWE-94, CWE-918).

- Skill name: `injection`
- Category: [DevOps & Security](https://www.openparable.com/skill/devops-security/1)
- Source: https://github.com/kubernetes-sigs/kueue/blob/HEAD/cmd/experimental/skills/reviewer/security/injection/SKILL.md
- Repository: kubernetes-sigs/kueue (2,719 GitHub stars when collected)

## SKILL.md

# Skill: Injection from User-Supplied Strings

- `os/exec` / `exec.Command` with user-controlled arguments (CWE-78, CWE-94).
- `http.Get` / `http.NewRequest` to URLs built from CR fields (CWE-918 SSRF).
  Container image refs, init-container pull specs, and webhook target URLs count as
  untrusted.
- `fmt.Sprintf` building YAML, JSON, label selectors, field paths, or API server URLs
  from user input. Require typed marshalling and `labels.SelectorFromSet`.
- Server-side template rendering of annotation/label values (CWE-94).
- SQL-like or query-language string concatenation against any external store.

---

Source: https://www.openparable.com/skill/devops-security/injection (OpenParable). Cite the canonical URL above.