feat(skills): Add dos-review skill for availability/DoS findings

[oioki]

Add a built-in dos-review skill for the availability / denial-of-service (resource-exhaustion) bug class — unbounded allocation, decompression bombs, uncontrolled recursion, non-terminating loops, panic/resource-leak, and unbounded delegation to third-party parsers.

Why

This class is currently unowned. When the find-bugs skill was removed in #195 its DoS checklist wasn't migrated: security-review is scoped to AppSec exploitability (its SPEC lists performance / non-security-correctness as out of scope), and code-review only reaches the allocation subset and gates findings on changed code. A decompression-bomb / unbounded-recursion DoS is both an availability-security issue and a resource-exhaustion correctness issue, so each existing skill's scope boundary pushes it to the other — and neither reports it.

What

• New src/builtin-skills/dos-review/{SKILL.md,SPEC.md} — sink-class table (alloc / decompression / recursion / non-termination / resource-leak / unbounded delegation), an investigation method that traces untrusted input to its sink across files and crates (including reading dependency source), a one-finding-per-root-cause dedup rule, and a severity rubric calibrated to recoverable-vs-persistent impact. Framed for whole-file / latent-bug audit rather than diff-regression, since these are usually pre-existing sinks.
• Register dos-review in BUILTIN_SKILL_NAMES (src/skills/loader.ts) and surface it in warden init next steps.
• One-line pointer from security-review's SPEC routing DoS / resource-exhaustion to dos-review (mirrors how code-review routes AppSec to security-review), so the class is discoverable from the skill teams already run.

Notes for review

• Kept as a separate skill rather than folded into security-review: the two have opposite precision/severity calibration (exploitability-gated high-confidence vs high-recall availability), and per-skill focus is why find-bugs was split in ref: Migrate to dotagents and add skills reference to AGENTS.md #195 — merging would re-create the orphan. The cross-pointer gives discoverability without the dilution.
• Validated internally against a corpus of known availability findings; detailed evaluation/evidence is held by the security team.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 9104839. Configure here.}

[cursor]

Stale built-in skill names test

Medium Severity

Adding dos-review to BUILTIN_SKILL_NAMES without updating the test that asserts the full built-in name list leaves loader.test.ts expecting only code-review and security-review, so the suite fails even though registration is correct.

 

^{Reviewed by Cursor Bugbot for commit 9104839. Configure here.}