# Injection

> Flag injection vectors from user-supplied strings — exec, SSRF, fmt.Sprintf-built selectors/URLs, template rendering, query concatenation (CWE-78, CWE-94, CWE-918).

- Skill: `kubernetes-sigs-kueue/injection` (Agent Skill)
- Install (CLI): `npx skillmds@latest add kubernetes-sigs-kueue/injection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kubernetes-sigs-kueue/injection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: kubernetes-sigs (https://skillmd.com/u/kubernetes-sigs-kueue)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/kubernetes-sigs-kueue/injection

---


# Skill: Injection from User-Supplied Strings

- `os/exec` / `exec.Command` with user-controlled arguments (CWE-78, CWE-94).
- `http.Get` / `http.NewRequest` to URLs built from CR fields (CWE-918 SSRF).
  Container image refs, init-container pull specs, and webhook target URLs count as
  untrusted.
- `fmt.Sprintf` building YAML, JSON, label selectors, field paths, or API server URLs
  from user input. Require typed marshalling and `labels.SelectorFromSet`.
- Server-side template rendering of annotation/label values (CWE-94).
- SQL-like or query-language string concatenation against any external store.