DOCA SHA Acceleration
Guidance for offloading SHA hashing to NVIDIA BlueField and ConnectX hardware.
The documentation scopes the skill to DOCA SHA, specifies minimum mmap permissions, requests confirmation of algorithm and buffer choices, requires known-vector validation, and routes installation, driver, and large-scale deployment work elsewhere. No credential theft, covert exfiltration, or destructive default is evident. Deductions apply because authorization boundaries for commands and hardware operations, rollback detail, sensitive-input data-flow handling, and dependency security are incomplete; the NOASSERTION license metadata also conflicts with file-level declarations.
SKILL.md, CAPABILITIES.md, and TASKS.md provide substantial lifecycle, capability-query, error-taxonomy, testing, and debugging guidance, including diagnosis before retry. Static files do not establish that key paths run; several paths depend on omitted shared skills and a local DOCA installation, and benchmark path, license, and version fields are inconsistent. The score is conservatively capped below the static-review limit of 10.
Triggers, representative questions, audience, non-fit boundaries, and one-shot versus partial-hash selection are clearly described, including C/C++ and FFI consumers. Deductions apply because the material is primarily English and gives no Chinese interaction or terminology guidance; core use requires BlueField/ConnectX, Linux, the DOCA SDK, and a local installation, with limited evidence of broader environment fit.
The loader-plus-companion-file structure supports progressive disclosure and includes examples, dependencies, limitations, related-skill routing, version guidance, maintenance contacts, and benchmark material. Deductions apply because release versioning and changelog information are incomplete, SKILLCARD version, signature, signing time, and scan ID remain TBD, repository-path and license statements conflict, and the benchmark reports missing recommended Instructions/Examples sections.
The material directly addresses capability discovery, task selection, permissions, error interpretation, build, testing, and debugging, and the benchmark reports positive evaluation results. Deductions apply because the skill intentionally provides no directly buildable code, key answers depend on local installation and other skills, the evaluation dataset is unavailable, and static review cannot confirm hardware outputs are directly usable without substantial rework. The score uses the static ceiling of 7.
The files expose API names, commands, error codes, test-vector guidance, and cross-references; BENCHMARK.md records evaluation metrics and results. Deductions apply because the evaluation dataset and full reproduction materials are absent, and no committed skill-specific test suite or CI coverage of the key hardware paths is shown. This supports only limited static auditability, below the static ceiling of 5.
- License and provenance metadata are inconsistent: the supplied metadata says NOASSERTION, while SKILL.md, SKILLCARD.yaml, skill-card.md, and repository material state different license combinations; reconcile and verify before publication.
- Do not treat the PASS verdict or benchmark percentages as independent validation for this review; the report states that the source evaluation dataset was unavailable.
- The workflows involve local hardware, DOCA installations, logs, and user data; confirm permissions, avoid sensitive data in logs, and validate capability queries, error handling, and known vectors on the actual device before relying on them.
- No Chinese trigger or output guidance is provided, which may reduce semantic triggering and explanation quality for Chinese users.
What does this skill do, and when should you use it?
This skill supports external developers building applications with the DOCA SHA library. It covers SHA-1, SHA-256, and SHA-512 offload on BlueField DPUs or ConnectX accelerators, including one-shot versus incremental hashing, capability discovery, buffer sizing, mmap permissions, and DOCA_ERROR_* diagnosis. It assumes the DOCA SDK is already installed and inspects the local package through pkg-config and standard DOCA directories. It does not cover DOCA installation, general hash theory, or other DOCA crypto libraries.
Inspects the local DOCA installation, including libraries, headers, samples, and applications, and checks the doca-sha pkg-config module. It guides use of doca_sha_task_hash and doca_sha_task_partial_hash; queries supported algorithms and source/destination buffer limits; sets doca_mmap permissions; interprets DOCA_ERROR_* results; and routes configure, build, modify, run, test, and debug workflows. It also covers task-completion events on the progress engine and language-neutral rules for FFI bindings.
- A C or C++ developer building BlueField-based SHA-256 file-integrity verification.
- A developer hashing multi-GiB input in chunks because the device source-buffer limit is smaller than the input.
- An engineer checking whether a device supports SHA-512 and determining the required destination buffer size.
- A developer diagnosing DOCA_ERROR_NOT_PERMITTED, INVALID_VALUE, or partial-hash state failures.
- A Rust, Go, or Python developer wrapping the DOCA SHA C ABI while preserving lifecycle, permission, and capability rules.
What are this skill's strengths and limitations?
- Covers the SHA-specific path from capability discovery through debugging.
- Clearly distinguishes one-shot and incremental hashing and includes device capability queries.
- Supports C/C++ consumers and other languages through the public C ABI and FFI.
- Defines a focused boundary for permissions, buffer sizing, errors, and task observability.
- Requires an existing DOCA SDK installation, Linux, and BlueField or ConnectX hardware.
- Does not ship application source code, bindings, build manifests, samples, or reference subtrees.
- Does not cover DOCA installation, BFB bring-up, general cryptographic theory, or other DOCA libraries.
- The supplied source does not provide a hardware-model coverage matrix or independent test results.
How do you install this skill?
Install the individual skill with the default skills CLI:
npx skills add nvidia/skills --skill doca-sha --yes
The README documents the CLI's --agent option for client-specific installation but does not provide a doca-sha-specific example. Runtime use also requires the DOCA SDK at /opt/mellanox/doca on Linux and an attached BlueField DPU or ConnectX NIC.
How do you use this skill?
After the DOCA prerequisites are available, give the agent a concrete DOCA SHA programming request, such as: “Hash a 1 GiB input with SHA-256 on the BlueField and decide whether to use partial hash or one-shot.” Read SKILL.md first; use CAPABILITIES.md for capabilities, algorithm enums, permissions, errors, and path selection, and TASKS.md for configure, build, modify, run, test, and debug workflows. Route missing DOCA installations to doca-setup.
How does this skill compare with similar options?
Use this guidance when hardware offload and device capability discovery justify DOCA SHA over CPU hashing with OpenSSL or similar. Other DOCA crypto libraries are named as alternatives for non-SHA work, but AES-GCM, Compress, and DMA are outside this skill's scope.