Summary
ListSkills accepts arbitrary page_size with no upper bound enforced server-side. A request with page_size: 2147483647 would attempt to return all rows.
Location
backend/internal/store/sqlite/sqlite.go (line 104)
Risk
Resource exhaustion / DoS via unbounded query result sets.
Suggested fix
Cap page_size at a reasonable maximum (e.g., 500) regardless of what the caller requests.
Summary
ListSkillsaccepts arbitrarypage_sizewith no upper bound enforced server-side. A request withpage_size: 2147483647would attempt to return all rows.Location
backend/internal/store/sqlite/sqlite.go(line 104)Risk
Resource exhaustion / DoS via unbounded query result sets.
Suggested fix
Cap page_size at a reasonable maximum (e.g., 500) regardless of what the caller requests.