·
Last changedVersion:
This version passed the hardening gate. Hardening updated the skill content and independently checked the resulting changes. Classified findings before hardening: 7. Classified findings closed: 0. Classified findings remaining: 7. Unclassified scanner findings remaining: 0. Review findings closed: 10. Review findings remaining: 3.
5
2
5
2
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Privilege Escalation & Host / Cloud Compromise | Privilege escalation | Medium | Open | |
TASKS.md | Privilege Escalation & Host / Cloud Compromise | Privilege escalation | Medium | Open | |
BENCHMARK.md | Privilege Escalation & Host / Cloud Compromise | Privilege escalation | Medium | Open | |
SKILLCARD.yaml | Privilege Escalation & Host / Cloud Compromise | Privilege escalation | Medium | Open | |
CAPABILITIES.md | Privilege Escalation & Host / Cloud Compromise | Privilege escalation | Medium | Open | |
CAPABILITIES.md | Malicious Code & Command Execution | Command injection | Low | Open | |
TASKS.md | Malicious Code & Command Execution | Command injection | Low | Open |
7 findings
pcc_counters.sh)Follow Loading order below. Open TASKS.md for run /
debug. Open CAPABILITIES.md for the fixed
counter set and the safety policy. Do not open every companion
file.
Operating rules (apply before any command):
pcc_counters.sh (set or query) and the read-only
sudo mst status -v listing. Use sudo for those commands only
under this skill.find /opt/mellanox/doca -type f -name pcc_counters.sh -print
step in TASKS.md, by its discovered absolute path,
after confirming the file is owned by root and writable only by
root. A copy in a source tree, home directory, or working
directory is reference material to read, not a command to run.
If a check fails, stop and route to
doca-setup.sudo mst status -v, and pass it quoted as a
single argument. Reject any path that is not in that listing or
that contains spaces or shell special characters. If more than
one PCI address could match, stop and confirm the PCI BDF with
the operator.set. Before set, show the exact
mst device path and the resolved PCI BDF, explain that set is
a root write to the mlx5 debugfs diag_cnt interface that
replaces the device's current diagnostic-counter selection, ask
whether anything else is using diag_cnt on that device, and
obtain the operator's explicit confirmation. Run it on that one
device. query runs only against an operator-confirmed mst
path. Full rule:
CAPABILITIES.md ## Safety policy.sudo mst status -v, mount | grep debugfs, and confirming the
script is present. Starting mst, mounting debugfs, or loading a
driver is a host-state change; stop and route it through
doca-setup.Where to start: This is a tool skill for invoking
pcc_counters.sh — a small bash script that arms and reads the
device's fixed set of firmware / hardware PCC diagnostic
counters (CNP count, RTT-perf, WRED-drop, RTT-gen, handled
events) through the mlx5 debugfs diag_cnt interface. Open
TASKS.md and start at ## run for
the canonical set-then-query sequence, or
## debug when the user reports
"ERROR: Bad Device", "counter stuck at zero", or "the
dump is empty". Open CAPABILITIES.md when
the question is which counters the script reports and how it
reaches them. If the user has not installed DOCA / MFT yet,
route to doca-setup first.
This skill is the firmware / HW PCC counter readout surface.
It is NOT the host-side control library that loads custom
congestion-control kernels onto the DPA (that is
doca-pcc) and it is NOT the
firmware PCC algorithm configuration (that path is firmware
configuration, routed via
doca-public-knowledge-map).
The counters this script reads are device / firmware
diagnostic counters that exist regardless of whether a custom
doca-pcc DPA kernel is running — do not condition them on a
custom kernel being loaded.
The CLASSES of pcc_counters.sh questions this skill is built
to answer, each with one worked example. The class is the
load-bearing piece; the worked example is one instance.
/dev/mst/mt41692_pciconf0".
Answered by the fixed counter set in
CAPABILITIES.md
set-then-query invocation in
TASKS.md.set | query + an mst device path) in
TASKS.md.ERROR: Bad Device — what's wrong?"
— worked example: "my device path is not matching".
Answered by the device-resolution layer in
CAPABILITIES.md
PCC_CNP_COUNT reads 0 after query". Answered
by the arm-before-read rule and the layered diagnosis in
TASKS.md +
CAPABILITIES.md.pcc_counters.sh present and where does the
install put it". Answered by the install overlay in
CAPABILITIES.md,
which redirects to the canonical
doca-version rules.This skill serves operators, developers, and AI agents who need to read a ConnectX / BlueField device's firmware PCC diagnostic counters to reason about congestion-control behaviour (CNP generation, RTT requests/responses, WRED drops) on a port. Concretely:
doca-pcc algorithm's
effect with the device-level PCC diagnostic counters
(the script reads the firmware counters; the custom
algorithm itself is a separate surface owned by
doca-pcc).It is not for users debugging the script's bash itself,
not the place to learn how to write a custom PCC
algorithm — that audience belongs in
doca-pcc — and not the
place for users who want to configure the factory firmware PCC
algorithm (route via
doca-public-knowledge-map).
pcc_counters.sh is shipped as a plain bash script
installed under the DOCA tools directory (per install_data in
tools/pcc_counters/meson.build), not a compiled binary and
not a library you link against. The skill uses the bundle's
kind: tool three-file shape (this skill + CAPABILITIES.md
configure / build / modify / run / test / debug) is uniform
across the bundle.Load this skill when the user is — or the agent needs to — arm and read the device PCC diagnostic counters on a host or BlueField Arm with the mst tools available and debugfs mounted. Concretely:
set on a target mst
device, after the confirmation gate above.query and quoting the
named counter lines verbatim.Do not load this skill for general DOCA orientation,
custom-PCC algorithm design, the host-side doca-pcc library
API, the factory firmware PCC algorithm, or DOCA / MFT install.
For those, route to
doca-public-knowledge-map,
doca-pcc, or
doca-setup.
This is a thin loader. Substantive material lives in two companion files:
CAPABILITIES.md — what pcc_counters.sh does: the exact
two-operation surface (set arms the device's diagnostic
counters by writing counter IDs + params to debugfs;
query reads the diag_cnt/dump and prints the named
counters), the FIXED firmware / HW counter set it knows
(PCC_CNP_COUNT, the MAD_RTT_PERF_CONT_*, the
*_EVENT_WRED_DROP family, HANDLED_*_EVENTS, the
DROP_RTT_PORT*/RTT_GEN_PORT* families), how it resolves
an mst device to a PCI address (mst status -v + lspci)
and reaches /sys/kernel/debug/mlx5/<pci>/diag_cnt/, the
install-availability overlay that redirects to
doca-version, the layered
error taxonomy (script-not-present / bad-device /
not-armed-before-query / debugfs-or-permission /
counter-stuck-at-zero / cross-cutting), and the safety
policy that flags set as a privileged debugfs write and
any CC tuning decision derived from a reading as
high-stakes.configure (read-only checks of the install, mst,
debugfs, and sudo; route any host-state change to install
guidance), build (route to install; nothing to
compile — it is a script), modify (refuse — do not patch
the shipped script), run (the set-then-query
sequence), test (confirm the dump contains the named
counters with finite values), debug (the layered
diagnosis ladder), plus a Deferred task verbs block and a
Command appendix.The skill assumes a host or BlueField where DOCA / MFT is
already installed (mst tools present, debugfs mounted, sudo
available for the installed script and the mst listing) and the
target device is visible to mst status -v.
This skill is agent guidance, not a samples or scripts bundle. To keep the boundary clean, it deliberately does not contain — and pull requests should not add:
pcc_counters.sh has
exactly two operations (set, query), takes exactly two
positional arguments, and has NO --help, --version,
list, snapshot, watch, or diff. Do not invent any.samples/ or reference/ subtree. This is a thin
loader for a documented script; substantive material lives
in the script and the public PCC documentation.CAPABILITIES.md.configure, build,
modify, run, test, debug, plus the Command appendix — see TASKS.md.doca-pcc — the host-side
library for writing and loading custom congestion-control
kernels onto the DPA. It is a SEPARATE surface: the
firmware PCC diagnostic counters pcc_counters.sh reads
exist independently of any custom doca-pcc kernel, but an
operator tuning a custom algorithm may read these counters
to observe device-level CC behaviour. Conflating the script
(firmware counter readout) with the library (custom
algorithm load/control) is the most common PCC first-touch
error.doca-public-knowledge-map
— routing to the public DOCA / PCC documentation set,
including the firmware PCC algorithm configuration.doca-version — canonical
DOCA version-handling rules. The ## Version compatibility
section in CAPABILITIES.md is a concise
overlay that redirects here.doca-setup — env preparation,
install verification, mst tools, debugfs, and the
I have no install yet path with the public NGC DOCA
container. This skill assumes its preconditions are
satisfied.doca-debug — the
cross-cutting debug ladder. The PCC counter readout slots
in as a read-only device-state evidence source before any
congestion-control tuning recommendation is made.doca-programming-guide
— general DOCA programming patterns shared across the
bundle.Get started with chainctlchainctl skill install public/nvidia/doca-pcc-counters:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.chainreg.biz/public/github.com/nvidia/skills/doca-pcc-counters:latest
Apache-2.0
BENCHMARK.md
CAPABILITIES.md
HARDENING.md
SKILL.md
SKILLCARD.yaml
TASKS.md
evals/evals.json
skill-card.md
skill.oms.sig