·
Last changedVersion:
This version passed the hardening gate. Hardening applied 2 targeted changes and preserved all other text. Classified findings before hardening: 2. Classified findings closed: 0. Classified findings remaining: 2. Unclassified scanner findings remaining: 0. Review findings closed: 3. Review findings remaining: 14.
2
2
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Privilege Escalation & Host / Cloud Compromise | Privilege escalation | Medium | Open | |
references/holohub-cli-contract.md | Privilege Escalation & Host / Cloud Compromise | Privilege escalation | Medium | Open |
2 findings
Take a non-failing application request from checkout selection to reviewable,
finite evidence through the public ./holohub workflow.
Require the task, checkout or starting workspace, and finite acceptance check. Take remaining values from the request or selected checkout; do not guess data rights or sensitive-data constraints. Benchmark details are optional unless performance work is requested.
Route a concrete failing or wrong ./holohub command to
holohub-debug-build-run, reusable Module or DEB/WHEEL work to
holohub-module-lifecycle, and first-time SDK host installation to
holoscan-setup. If the matching skill is unavailable, preserve the handoff
context instead of improvising its workflow.
At any step, a failing effect-bearing wrapper command ends this happy path;
follow Troubleshooting with its exact context. Parse read-only diagnostic
results such as env-check --json and stop only when a failed capability is
required by the selected project's documented needs or the requested proof.
create. Treat preview as
potentially mutating. Obtain any repository-required approval for parent
CMake registration; if denied or setup fails, stop before creation. Do not
replace an existing app.--no-docker-build only after one matching build/run. Use
--no-local-build only when current artifacts or mounted-source execution
are proved sufficient. Rebuild after image or setup changes.git diff --check, and
final status. In an explicitly selected dirty checkout, restrict
auto-fixing lint to task paths; before a requested commit, validate the
exact candidate change with the repository-required full lint in a clean
disposable checkout rather than rewriting unrelated work. Do not commit or
push unless requested.If a wrapper command begins failing, stop the happy path and hand off its exact
command, revision, dirty state, inputs, and observed result to
holohub-debug-build-run.
./holohub run failure: use
holohub-debug-build-run.sudo ./holohub, recursively search the home directory, turn a
data workspace into HoloHub, overwrite a nonempty destination, or stage
external data.Return a concise report covering workspace and checkout provenance, reused patterns, changes, preview and real command results, finite and visual evidence, tests and lint, benchmark protocol when requested, final worktree state, and licensing or claim limits.
For a planning-only request, return the proposed order, assumptions, approval boundaries, and proof requirements without claiming execution results.
Get started with chainctlchainctl skill install public/nvidia/holohub-app-lifecycle:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.chainreg.biz/public/github.com/nvidia/skills/holohub-app-lifecycle:latest
Apache-2.0
BENCHMARK.md
HARDENING.md
SKILL.md
evals/evals.json
evals/extended-evals.json
references/application-workflow.md
references/flow-benchmarking.md
references/holohub-cli-contract.md
skill-card.md
skill.oms.sig