# Nil Safety

> Flag unguarded dereferences of optional pointer fields reachable from a malformed CR, and goroutines without recover (CWE-476).

- Skill: `kubernetes-sigs-kueue/nil-safety` (Agent Skill)
- Install (CLI): `npx skillmds@latest add kubernetes-sigs-kueue/nil-safety`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kubernetes-sigs-kueue/nil-safety/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: kubernetes-sigs (https://skillmd.com/u/kubernetes-sigs-kueue)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/kubernetes-sigs-kueue/nil-safety

---


# Skill: Nil-Safety and Crash Resistance (CWE-476)

- Unguarded dereferences of optional pointer fields reachable from a malformed CR
  (`Workload.Status.Admission`, `ClusterQueue.Spec.Cohort`, optional sub-structs, slice
  elements). A panic in scheduler cache construction or webhook handling wedges the
  scheduling loop — treat as **high severity**.
- Goroutines launched outside the controller-runtime workqueue without a deferred
  `recover()` or a documented panic policy.