dpdisp-submit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited dpdisp-submit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This Skill guides the Agent to use the DPDispatcher tool to convert Shell commands into computational jobs and submit them to local machines or High-Performance Computing (HPC) clusters (supporting environments such as Shell, Slurm, PBS, LSF, Bohrium, etc.).
Prerequisites: uv and internet access.
This section defines the field mappings, variable syntax, and special flags for the configuration file.
As an Agent, before gathering information and building the configuration, you MUST FIRST execute the following command to read and learn the latest Schema protocol specifications and requirements:
uvx --with dpdispatcher dargs doc dpdispatcher.entrypoints.submit.submission_argsYou must accurately translate the gathered user requirements into the following core JSON hierarchy:
machine: Defines the execution location and method (connection protocol, scheduler type).resources: Defines the computational resource requirements (nodes, CPUs, GPUs, queues, etc.).task_list: Defines the specific Shell commands to be executed and the file flow paths.If user-specified values (e.g., username, Token, remote path) need to be read from local environment variables, you must strictly use the ${ENV_VAR_NAME} format in the template.
"remote_root": "${USER_HPC_WORKSPACE}"The protocol allows the use of the {"$ref": "other.json"} syntax to nest and reference reusable configuration snippets from other JSON files (the referenced file is loaded first, and then the current file's fields override or extend it). The relative path for $ref is resolved relative to the execution directory where submission.json is located. You must ensure that the execution path strictly matches the path pointed to by $ref.
. (i.e., the current execution directory).task_work_path is resolved relative to work_base, whereas the file paths specified in forward_files are strictly resolved relative to task_work_path.Parses the configuration, generates local directories, and validates the Schema, but DOES NOT actually submit the job to the machine or cluster. You can use this flag for a final safety check before real execution.
As an Agent, you MUST strictly execute tasks in the sequence of the following stages, without skipping any steps:
When feeling vague or uncertain about the specific parameters and configuration information for running the job, you MUST proactively ask the user in natural language to supplement the necessary information.
You MUST generate the configuration file based on the acquired Schema protocol and the gathered information.
submission.json.submission.template.json file, using the ${VAR_NAME} syntax ONLY for the variables that need to be replaced.envsubst command and explicitly list the variables to be replaced to prevent unrelated $… symbols in the JSON (such as "$ref") from being accidentally expanded. envsubst '${USER_HPC_WORKSPACE} ${USER_OTHER_VAR}' < submission.template.json > submission.jsonYou MUST choose the command chain that matches the configuration and execute it in sequence. Keep the same choice for every later resume or synchronization run.
For a configuration without $ref, keep external references disabled:
# Logic and Schema Validation
uvx --with dpdispatcher dargs check -f dpdispatcher.entrypoints.submit.submission_args submission.json
# Submit Job
uvx --from dpdispatcher dpdisp submit submission.jsonFor a configuration that uses $ref, pass --allow-ref to both validation and submission; omitting it makes a valid referenced configuration fail:
# Logic and Schema Validation
uvx --with dpdispatcher dargs check --allow-ref -f dpdispatcher.entrypoints.submit.submission_args submission.json
# Submit Job
uvx --from dpdispatcher dpdisp submit --allow-ref submission.jsonAfter execution finishes, you MUST output a structured report to the user with the following fixed elements:
task_work_path is ., point out the specific paths of log and err).High-performance computing tasks usually take an extremely long time (from hours to weeks), and there is a long time gap between the submission command and the final result. This is not a one-off, instant Q&A process, and you must choose the appropriate disconnect-prevention execution mode based on the specific scenario:
dpdisp submit submission.json. The program will continuously hang and wait until the job is truly finished calculating on the cluster and the files are downloaded back before exiting. You must run it inside a tmux session to prevent any possible disconnection from killing the process.<exit_code>. It will not wait for execution to complete or download outputs.0. At this time, the job is only accepted by the backend, may be queuing, and output files are temporarily unavailable.submission.json or attempt to clean up the remote directory. You simply need to re-execute the exact same submission command (e.g., uvx --from dpdispatcher dpdisp submit submission.json --allow-ref) as is in the same directory.Timeline Example (Non-blocking Mode):
>
- [Day 1, 10:00] Submit job:dpdisp submit --exit-on-submit submis_task.json- [Day 1, 10:01] The command exits immediately and returns 0. At this time, it is only in the Successfully Submitted state. The Agent can exit the terminal to execute other tasks. - [Waiting Period] (A long queuing and calculation phase, potentially lasting for days) - [Day 3, 15:00] The Agent returns to the directory to check: triggers the idempotent recovery mechanism, re-runsdpdisp submit submis_task.jsonwithout the flag as is to synchronize the state and trigger file downloading. Only after the download is complete is it marked as Fully Completed.
Before performing any operation, as an Agent, you MUST UNCONDITIONALLY obey the following security baselines:
ssh, write custom Paramiko/Fabric Python scripts, or manually execute remote commands. All remote connections, file transfers, and job management MUST AND ONLY be safely handled by DPDispatcher by generating submission.json and calling the dpdisp submit tool.envsubst to generate the final submission.json, you are ABSOLUTELY PROHIBITED from reading or printing the contents of the file. The file contains raw sensitive data, and reading it will cause confidential information to leak into the current conversation context.User request: "Please run the simulation located in the task02 directory on my Slurm cluster. Load my username from $HPC_USER and the workspace path from $HPC_WORKDIR. We already have a resource_defaults.json in the parent workspace directory, please reference it and just add the debug queue."
The Agent discovers that the current directory structure is as follows:
<WORKSPACE>/
├── resource_defaults.json
├── ...
└── run_dir/
├── ...
└── task02/
├── run_simulation.sh
├── ...
└── data/
├── input.dat
└── ...The Agent decides to create the configuration file submis_task02.template.json within the run_dir/ directory (at the same level as the task02/ folder). The Agent has remembered the $ref pointing to the parent directory ../, the task_work_path explicitly targeting "task02", and forward_files remaining strictly relative to that task_work_path. Then it writes down:
{
"work_base": ".",
"machine": {
"batch_type": "Slurm",
"context_type": "SSHContext",
"remote_profile": {
"hostname": "<target-host>",
"username": "${HPC_USER}",
"port": 22
},
"remote_root": "${HPC_WORKDIR}/dpdisp_run"
},
"resources": {
"$ref": "../resource_defaults.json",
"queue_name": "debug",
"group_size": 1
},
"task_list": [
{
"command": "bash run_simulation.sh",
"task_work_path": "task02",
"forward_files": [
"run_simulation.sh",
"data/input.dat"
],
"backward_files": [
"result.out",
"log",
"err"
]
}
]
}Then the Agent run the validation and submission commands from within the <WORKSPACE> directory:
cd run_dir/
envsubst '${HPC_USER} ${HPC_WORKDIR}' < submis_task02.template.json > submis_task02.json
uvx --with dpdispatcher dargs check --allow-ref -f dpdispatcher.entrypoints.submit.submission_args submis_task02.json
tmux new-session -d -s dpdisp_task02 "uvx --from dpdispatcher dpdisp submit --allow-ref submis_task02.json"
tmux ls~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.