·
Last changedVersion:
This version passed the hardening gate. Hardening applied 6 targeted changes and preserved all other text. Classified findings before hardening: 6. Classified findings closed: 0. Classified findings remaining: 6. Unclassified scanner findings remaining: 0. Review findings closed: 6. Review findings remaining: 15.
5
1
5
1
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
references/failure-decision-tree.md | Sensitive Data & Secret Exposure | Data exfiltration | Medium | Open | |
SKILL.md | Tool & MCP Manipulation | MCP over-permissioning | Medium | Open | |
scripts/collect_dynamo_debug_bundle.py | Malicious Code & Command Execution | Dynamic code execution | Medium | Open | |
BENCHMARK.md | Sensitive Data & Secret Exposure | Agent snooping | Medium | Open | |
SKILL.md | Prompt Injection | Indirect prompt injection | Medium | Open | |
references/failure-decision-tree.md | Privilege Escalation & Host / Cloud Compromise | SSRF and cloud metadata access | Low | Open |
6 findings
Turn a Dynamo failure into a clear problem class, strongest signal, and next action. Start with read-only evidence, avoid secrets, and fix one layer at a time.
kubectl configured with read access to the target namespace.DynamoGraphDeployment resources (NOT secrets).Run:
If the user names a deployment, include it:
Do not collect Kubernetes secrets. Do not print Hugging Face tokens.
Use references/failure-decision-tree.md and classify into one primary bucket:
Check in this order:
DynamoGraphDeployment status and eventsdescribe pod, and container logs/v1/models/v1/chat/completionsPrefer the smallest reversible change:
storageClassNameAfter each fix, rerun the relevant readiness check before moving deeper.
| Script | Purpose | Arguments |
|---|---|---|
| Collect a read-only debug bundle (pods, events, jobs, PVCs, CR status) |
|
Invoke via the agentskills.io run_script() protocol:
Collect everything in a namespace for triage:
Scope to a single failing deployment:
Equivalent through the agent protocol:
Return:
--deployment-name.dynamo-interconnect-check for that.| Symptom | Likely cause | Next step |
|---|---|---|
| Service account lacks read RBAC | Ask operator for read-only role binding on the namespace |
Bundle missing | Operator not installed or different namespace | Verify |
Model-download job in | PVC unbound or HF secret missing | Fix PVC binding or create the named HF secret, then rerun the job |
Worker pods | Image/runtime mismatch or GPU not available | Inspect container logs; check |
See BENCHMARK.md for the NVCARPS-EVAL performance report (auto-generated by the NVSkills CI pipeline).
references/failure-decision-tree.md for bucket-specific checks.scripts/collect_dynamo_debug_bundle.py for read-only bundle collection.Get started with chainctlchainctl skill install public/nvidia/dynamo-troubleshoot:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/nvidia/skills/dynamo-troubleshoot:latest
Apache-2.0
BENCHMARK.md
HARDENING.md
LICENSE
SKILL.md
evals/evals.json
references/failure-decision-tree.md
scripts/collect_dynamo_debug_bundle.py
skill-card.md
skill.oms.sig