·
Last changedVersion:
This version passed the hardening gate. Hardening applied 4 targeted changes and preserved all other text. Classified findings before hardening: 5. Classified findings closed: 1. Classified findings remaining: 4. Unclassified scanner findings remaining: 0. Review findings closed: 13. Review findings remaining: 4.
1
4
4
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Privilege Escalation & Host / Cloud Compromise | Privilege escalation | Medium | Closed | |
SKILL.md | Malicious Code & Command Execution | — | Low | Open | |
SKILL.md | Tool & MCP Manipulation | MCP configuration abuse | Low | Open | |
SKILL.md | Prompt Injection | Third-party content as instructions | Low | Open | |
SKILL.md | Supply Chain & Install-Time Trust | Install-time download and execute | Low | Open |
5 findings
Install the Holoscan SDK Python bindings via the holoscan-cu12 / holoscan-cu13 pip wheel into a virtual environment.
nvidia-smi).PATH matching the host CUDA major (12 or 13).venv available.docs.nvidia.com./holoscan-install-debian.holoscan-cu12 and holoscan-cu13 are mutually exclusive — wheel must match host CUDA driver.video_replayer data ships only with the Debian package; without it, set HOLOSCAN_INPUT_PATH to a directory containing racerx/.ulimit -s 32768 is recommended in every shell that runs Holoscan — without it some apps emit a stack-size warning or, in rarer cases, segfault.Always fetch the pip-wheel section of https://docs.nvidia.com/holoscan/sdk-user-guide/sdk_installation.html before installing. Extract: exact wheel package names (holoscan-cu12, holoscan-cu13), the supported Python range for the current release, prerequisites that must be on PATH (CUDA Toolkit), and any optional extras (LibTorch / ONNX Runtime version pins).
You need the CUDA variant already determined. If not known, run nvidia-smi 2>&1 | head -5 first.
CUDA variant rule — pick the pip package:
| nvidia-smi CUDA Version | pip package |
|---|---|
13.x+ |
|
12.x (any GPU) |
|
Prerequisites: CUDA Toolkit on PATH, Python 3.10–3.13. Optional extras: LibTorch 2.11.0+, ONNX Runtime 1.22.0+.
Always install into a Python virtual environment — this avoids system-package conflicts and is required on Ubuntu 24.04 (which blocks system-wide pip entirely).
Check if one exists first:
If missing:
Then activate:
The venv must be active for all commands below.
They must activate the venv in each new shell session:
Then offer next steps:
https://github.com/nvidia-holoscan/holoscan-sdk/tree/v<VERSION>/examples/explain-examplepip install holoscan-cu12 errors with "externally-managed-environment". Ubuntu 24.04 blocks system-wide pip. Create and activate the venv from Step 1 first.ImportError / wrong CUDA at import holoscan. Wheel variant doesn't match host CUDA. Uninstall and reinstall the matching one: pip uninstall -y holoscan-cu13 && pip install holoscan-cu12 (or vice versa).RuntimeWarning: stack size .... Harmless, but set ulimit -s 32768 in the current shell to silence it.ulimit -s 32768 wasn't set. Set it before python3 ....video_replayer can't find racerx/. HOLOSCAN_INPUT_PATH isn't pointing at a directory containing it. Install the Debian package for /opt/nvidia/holoscan/data, or set HOLOSCAN_INPUT_PATH to wherever the data lives.source: no such file: ~/holoscan/venv/bin/activate in a new shell. Venv wasn't created or path differs. Re-run Step 1 or correct the path.Get started with chainctlchainctl skill install public/nvidia/holoscan-install-wheel:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/nvidia/skills/holoscan-install-wheel:latest
Apache-2.0
BENCHMARK.md
HARDENING.md
LICENSE
SKILL.md
evals/evals.json
skill-card.md
skill.oms.sig