A specialized security auditing skill for Go developers to identify and mitigate Denial of Service (DoS) and resource exhaustion vulnerabilities.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install go-vuln-dos
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install go-vuln-dos using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Go DoS and Resource Exhaustion Auditor?
This skill provides a comprehensive framework for auditing Go applications against CWE-400, CWE-770, and CWE-476 patterns. It focuses on critical areas such as goroutine management, channel operations, and unbounded memory allocations that can lead to system instability or crashes.
By leveraging this tool within Openclaw Skills, developers can systematically scan for high-risk sinks like uncontrolled goroutine creation, infinite IO reading, and unsafe JSON/Protobuf decoding. It bridges the gap between raw code and security compliance by providing specific detection strategies and sanitization patterns tailored for the Go ecosystem.
Go DoS and Resource Exhaustion Auditor Use Cases
- Auditing HTTP handlers for missing panic recovery in child goroutines.
- Identifying potential memory exhaustion (OOM) in large file uploads or API requests.
- Detecting goroutine leaks in long-running services using context-sensitive analysis.
- Validating channel safety to prevent permanent deadlocks in concurrent logic.
- Securing Protobuf and YAML parsers against exponential expansion attacks.
How Go DoS and Resource Exhaustion Auditor Works
- Identify potential attack sources such as HTTP request bodies, gRPC messages, or user-controlled allocation parameters.
- Scan for resource-intensive sinks including make calls, goroutine spawns, and IO read operations.
- Verify the presence of sanitization barriers like LimitReader, MaxBytesReader, or context timeouts.
- Trace the data flow from untrusted input to resource allocation to confirm if proper limits are enforced.
- Flag any unprotected paths as candidate vulnerabilities for remediation.
Go DoS and Resource Exhaustion Auditor Setup
To use this skill for auditing, you can start by running targeted grep commands in your Go workspace:
# Find unbounded memory allocations
grep -rn "make(\[\]byte\|make(\[\]" --include="*.go"
# Detect potential goroutine leaks
grep -rn "go func\|go .*(" --include="*.go"
# Check for missing body limits in IO operations
grep -rn "io.ReadAll\|ioutil.ReadAll" --include="*.go"
Go DoS and Resource Exhaustion Auditor Data Schema & Taxonomy
The skill organizes vulnerability patterns based on Common Weakness Enumeration (CWE) standards and Go-specific language features:
| Category | CWE Mapping | Primary Go Sinks |
|---|---|---|
| Resource Exhaustion | CWE-400/770 | go func(), io.ReadAll, make() |
| Allocation Issues | CWE-789 | make([]T, userSize) |
| Improper Recovery | CWE-476 | Unprotected panic() in child goroutines |
| Concurrency Deadlocks | CWE-400 | Unbuffered channels without select default |
Go DoS and Resource Exhaustion Auditor Advanced Features
- Context-aware goroutine leak detection using
ctx.Done()monitoring. - Detection of exponential YAML expansion (Billion Laughs) and Protobuf nesting depth issues.
- Automated identification of HTTP/2 Rapid Reset vulnerability (CVE-2023-44487) configurations.
- False positive exclusion logic for background workers and trusted internal configurations.
- Support for multi-agent security orchestration via Openclaw Skills integration.
SKILL.md
Loading
Related Openclaw Skills
SenseAudio Voice Meme Maker
A specialized tool for generating humorous audio memes and stylized voice clips using the SenseAudio TTS API.
Sportfolio
An advanced integration for Openclaw Skills that enables agent-assisted sports portfolio management, market analysis, and trade staging via MCP or CLI.
Privacy Guard
A security-focused skill that prevents sensitive data leakage by performing deep content inspection on files before they are accessed or transmitted by an AI agent.
BTC Signals Pro
BTC Signals Pro provides institutional-grade Bitcoin trading intelligence and AI-driven market signals for automated bots and professional traders.
Transfer Skill To Windows
A specialized tool for adapting AI agent skills from Unix-based environments to work natively on Windows systems.
Developer Interview Simulator
A comprehensive technical interview trainer providing mock coding, system design, and behavioral rounds for software engineers.
Featured*
