56 results available
Sign in
Skills directory

nemo-relay-instrument-context-isolation

nvidia

·

Last changed
Hardened

This skill has been hardened by Chainguard

Last changed

This version passed the hardening gate. The skill content was retained without changes. Classified findings before hardening: 1. Classified findings closed: 0. Classified findings remaining: 1. Unclassified scanner findings remaining: 0. Review findings closed: 0. Review findings remaining: 5.


Open before hardening

1

Medium
Open after hardening

1

Medium

Expand
File
Group
Subtype
Severity
Status
BENCHMARK.md

Sensitive Data & Secret Exposure

Agent snooping

Medium
Open

1 finding


SKILL.md

Use Context Isolation

Use this skill when an application runs concurrent requests, worker pools, async tasks, goroutines, or multiple agents in the same process. Treat scope-stack ownership as part of the request boundary.

Core Rule

Each independent request, agent, or workflow needs its own scope stack. Do not share one mutable stack across unrelated concurrent work unless you want shared ancestry and shared scope-local middleware.

Embedded Scope Model

  • A root scope is always present, and pushed scopes form a parent-child tree beneath it.
  • Scope hierarchy determines event parentage, lifetime boundaries, and visibility for scope-local middleware and subscribers.
  • Standard scope types include Agent, Function, Tool, Llm, Retriever, Embedder, Reranker, Guardrail, Evaluator, Custom, and Unknown.
  • Scope start and end events can carry semantic input and output payloads when the scope represents a request, task, or meaningful result boundary.
  • Scope-local registrations disappear when the owning scope closes; use them for behavior that should not outlive a request or agent run.
  • Mark events are useful for retries, checkpoints, interrupts, and important state transitions that are not full spans.

Per-Language Defaults

  • Python: rely on task-local behavior via get_scope_stack() and contextvars, or explicitly propagate when work leaves the current execution context
  • Rust core: use runtime helpers such as create_scope_stack(), current_scope_stack(), and set_thread_scope_stack(...) when an integration needs explicit stack ownership
  • Go: use NewScopeStack() and ScopeStack.Run(...) for goroutine-safe usage
  • Node.js: create and set a scope stack explicitly for the current execution path with createScopeStack() and setThreadScopeStack(...)

Common Failures

  • Events from different requests appear under one root UUID
  • Scope-local middleware leaks across requests
  • Worker-thread work runs without the expected active scope
  • Integrations activate NeMo Relay without an explicitly initialized stack
  • Relying on a thread-local stack after crossing async tasks, goroutines, or JS worker boundaries
  • nemo-relay-instrument-calls
  • nemo-relay-plugin-observability
  • nemo-relay-debug-runtime-integration

Install

Install with chainctl
chainctl skill install public/nvidia/nemo-relay-instrument-context-isolation:latest
Get started with chainctl
View source

Harden your own skills

Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.

Provenance

Upstream sourcehttps://github.com/nvidia/skills
Upstream commit31bd53822c1ac5998a23bd5f7c9efb5aefe99ca2
OCI reference

skills.chainreg.biz/public/github.com/nvidia/skills/nemo-relay-instrument-context-isolation:latest

License

Apache-2.0

Files

BENCHMARK.md

HARDENING.md

LICENSE

SKILL.md

evals/evals.json

skill-card.md

skill.oms.sig


The trusted source for open source

Talk to an expert
PrivacyTerms

Product

Chainguard ContainersChainguard LibrariesChainguard VMsChainguard OS PackagesChainguard ActionsChainguard Agent SkillsIntegrationsPricing
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.