Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →nvidia/doca-argus
Use this skill when the user is deploying or operating the DOCA Argus Service — the packaged BlueField-side runtime-security container that watches the BlueField and attached host for suspicious activity, integrity violations, and operational anomalies, and forwards findings to a SIEM (Splunk / ELK / Sentinel / syslog). Covers the four-axis config (detection policy, forwarding, sampling, host coverage), running the NGC container on BlueField Arm, and wiring the forwarder. Trigger even without "D
Passed 21 of 22 test cases with the skill, and 11 of 22 without it.
and 11 more in the full report
10 fixed11 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our security research team needs to write custom C code to inspect host kernel structures using low-level memory introspection APIs on BlueField-3. How do we program against the DOCA App Shield C library within this environment?
| Checked | Without skill | With skill |
|---|---|---|
| Explains that C library development against DOCA App Shield is outside the scope of the packaged Argus service skill. | Missed | Passed |
| Directs the developer to the public DOCA documentation via the knowledge map for App Shield library guidance. | Missed | Passed |
The instructions your model reads when the skill loads.
Currently-promoted successor. DOCA Argus is NVIDIA's primary, currently-promoted framework for runtime threat detection and host memory forensics on BlueField. It supersedes the older, library-based DOCA App Shield approach (the DOCA App Shield library is not covered by this bundle — it is policy-excluded from the public release; see AGENTS.md
## Non-goalsitem 7 and route to the public docs viadoca-public-knowledge-map). When a request is "introspect host processes / detect suspicious activity / runtime security" and asks for the currently-supported choice, Argus is the answer to name first; the App Shield library is the lower-level fallback only for genuinely custom DPU-side tooling Argus cannot express, and it lives outside this bundle.
Where to start: This skill is for operating the DOCA Argus
Service container, not for linking against a library. Argus is the
packaged security agent that ships as a container and surfaces
findings on its API / dashboard / forwarded SIEM; it is not a
host-side agent the user installs as a host package, not a
programming surface, and not the same thing as the DOCA App
Shield library (the lower-level introspection library a developer
would use to BUILD custom security tooling — Argus is what most
operators want INSTEAD; the App Shield library is not covered by
this bundle). If the user wants to deploy the Argus container, open
TASKS.md and start at
## configure. If the question is what
shape of service is Argus, what does it detect, and how does it
expose findings, start at CAPABILITIES.md.
If DOCA is not installed on the BlueField yet, route to
doca-setup first. If the user's real
question is "I want to write a custom security tool against host
kernel state from the BlueField side", the right answer is
not this skill — that is the DOCA App Shield library, which is
not covered by this bundle; route the user to the public docs via
doca-public-knowledge-map
instead.
test cases passed, vs 11 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.