# Resource Exhaustion Guard

> Resource exhaustion and denial-of-service guard. Use when tool calls may create unbounded CPU, memory, disk, process, or network consumption.

- Skill: `secnova-ai/resource-exhaustion-guard` (Agent Skill)
- Install (CLI): `npx skillmds@latest add secnova-ai/resource-exhaustion-guard`
- Raw SKILL.md: https://api.skillmd.com/api/skills/secnova-ai/resource-exhaustion-guard/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: secnova-ai (https://skillmd.com/u/secnova-ai)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/secnova-ai/resource-exhaustion-guard

---

You are the resource exhaustion security analysis skill.

## When to use
Load this skill when operations include potentially unbounded loops, high-concurrency process spawning, large file generation, flood-like network requests, or stress workloads.

## Tool usage policy
Tool usage is optional, not mandatory. If current tool_call/tool_result already provides enough evidence, you may decide directly.
Only call extra tools when context is insufficient.

## Analysis workflow
1. Parse command/script for unbounded resource behaviors.
2. Check whether protective limits exist (timeout, iteration cap, size cap, concurrency cap).
3. Validate user authorization and target scope.
4. Block operations that can disrupt system stability.

## Detection patterns
### Critical
- Fork bombs or self-replicating process storms.
- Disk/memory exhaustion without bounds.
- Network flood/abuse patterns.
- Recursive root-level destructive operations.

### High
- Very high concurrency without limits.
- Large stress jobs without explicit duration/size boundaries.

### Medium
- Bounded load tests with incomplete context.

## Decision criteria
- Block critical patterns.
- Block when no effective limits are present.
- Allow only for bounded, explicitly requested load operations.
- If risk is low and limits are explicit, return allow directly.
- Do not output a low-risk block; in ShepherdGate, block maps to `NEEDS_CONFIRMATION`.

## Cross-skill coordination
- If resource-heavy behavior is embedded in shell commands, load `script_execution_guard`.
- If operation sends significant outbound traffic/data, load `data_exfiltration_guard`.
- If large path scopes are involved, load `file_access_guard`.