·
Last changedVersion:
This version passed the hardening gate. Hardening updated the skill content and independently checked the resulting changes. Classified findings before hardening: 5. Classified findings closed: 3. Classified findings remaining: 2. Unclassified scanner findings remaining: 0. Review findings closed: 4. Review findings remaining: 9.
5
2
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Privilege Escalation & Host / Cloud Compromise | Privilege escalation | Medium | Open | |
SKILL.md | Tool & MCP Manipulation | MCP configuration abuse | Medium | Open | |
SKILL.md | Sensitive Data & Secret Exposure | Agent snooping | Medium | Closed | |
BENCHMARK.md | Sensitive Data & Secret Exposure | Agent snooping | Medium | Closed | |
SKILL.md | Excessive Agency & Rogue Autonomy | — | Medium | Closed |
5 findings
Read this when helping someone use cuOpt (calling the SDK, installing, deploying the server). For modifying cuOpt itself, switch to cuopt-developer.
Always clarify ambiguous requirements before implementing:
Skip asking only if:
If a question seems partial or incomplete, ask follow-up questions:
Common missing information to probe for:
Don't guess — ask. A brief clarifying question saves time vs. solving the wrong problem.
Before generating examples, ask about data:
Check if user has data:
If using synthesized data:
Always document what you used:
State assumptions explicitly:
Before writing substantial code, you MUST confirm your understanding:
After providing a solution, guide the user to verify:
Optimal / FeasibleFound / SUCCESS?Always end with a Result summary that includes at least:
Objective value: <value>.Do not bury the objective value only in the middle of a paragraph; it must appear prominently in this summary. Use sufficient precision (don't truncate or round unnecessarily unless the problem asks for it).
Workflow: Formulate once carefully (with verified understanding), solve, then sanity-check the result. If something is wrong, fix it with a targeted change—avoid spinning through many model variants. Decide, implement, verify, then move on.
Provide diagnostic code snippets when helpful.
Before writing code or suggesting installation, verify the user's setup:
Ask how they access cuOpt:
Different packages by language/interface:
| Language / Interface | Package | Check |
|---|---|---|
Python |
|
|
C |
|
|
REST Server |
|
|
CLI |
|
|
Note: cuopt declares libcuopt as a runtime dependency, so installing the Python package also installs the C library and headers. Installing libcuopt on its own does not install the Python API.
If not installed, ask how they want to access:
Never assume installation is needed — the user may:
Ask before running any verification commands:
Do not execute commands or code without explicit permission:
| Action | Rule |
|---|---|
Shell commands | Show command, explain what it does, ask "Should I run this?" |
Package installs | Allowed in user space once the user confirms they want cuOpt installed — see below. Only |
Examples/scripts | Show the code first, ask "Would you like me to run this?" |
File writes | Explain what will change, ask before writing |
Never do these:
sudo or run as root/etc)If a task seems to need one of these, stop and explain what's needed — the user runs the privileged step themselves. Installs into a user-space environment are not privileged and are covered below.
Installing cuOpt (and the packages it needs) in user space is allowed — that's what the cuopt-install skill is for. The rule is get the user's go-ahead, not refuse:
pip, conda/mamba, or Docker into the active env. Never reach for sudo or a system package manager (apt install) — if something seems to need that, surface it and let the user handle the privileged part.-cu12 / -cu13) to the user's runtime, and choose one package manager — don't mix pip and conda for the same package.Get started with chainctlchainctl skill install public/nvidia/cuopt-user-rules:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/nvidia/skills/cuopt-user-rules:latest
Apache-2.0
BENCHMARK.md
HARDENING.md
LICENSE
SKILL.md
evals/evals.json
skill-card.md
skill.oms.sig