image-debug — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited image-debug (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
projtool builds project images by spinning up a one-shot AutoDL "builder" instance, running the project's setup.sh inside it, and (on success) saving the result as a custom image. This skill activates when something goes wrong during setup.sh. Most failures fall into a small number of categories, listed below — read the relevant references/ file before proposing a fix.
has all the partial state. Closing it loses minutes of debug context.
mcp__projtool__remote_exec returnsstderr_tail (and stdout_tail) inline in the response; the full output is written to the file at log_path in the result. The error message is almost always in the last 30 lines of stderr_tail.
setup.sh locally + push it to theinstance via write_remote_file, or run the fix command directly via remote_exec to validate before bake-in. For non-trivial changes, patching setup.sh is preferred — it makes the next build idempotent. For AutoDL PyTorch base images, make the first line after set -euo pipefail export Miniconda onto PATH: export PATH="/root/miniconda3/bin:$PATH". Some non-interactive SSH shells do not source bashrc, so plain python / python3 may otherwise be missing even though the image has conda.
setup.sh. Most steps areidempotent (apt-get, pip install). Only re-run the full script when confident the earlier steps will no-op cleanly.
Then: image_save (non-blocking — returns pending_image_uuid immediately) → poll image_save_status until image_status='ready' → image_build_finalize. Saving an image with hidden partial state (e.g., wrong CUDA toolkit) creates a long-tail bug.
image_build_abandon releases the builder. Don't leavebuilders running — they bill at GPU rates.
| Category | Trigger | Reference |
|---|---|---|
| pip install failed | ERROR: Could not find a version / ResolutionImpossible / wheel build crash | references/pip-failures.md |
| apt install failed | E: Unable to locate package / E: Sub-process … returned … exit status | references/apt-failures.md |
| CUDA / driver mismatch | torch import works locally but fails on remote with CUDA error: no kernel image is available / mismatch in nvidia-smi vs torch.version.cuda | references/cuda-mismatch.md |
| Disk full | No space left on device | Inline below |
| Network / mirror unreachable | Could not connect to mirrors.aliyun.com / Connection timed out | Inline below |
Builder images sometimes have small system disks (typically 30–50GB). pip caches and apt downloads chew it fast.
df -h / # see what's full
apt-get clean # frees /var/cache/apt
pip cache purge # frees ~/.cache/pip
rm -rf /tmp/* # if anything is staged thereIf /root/autodl-tmp/ is mounted with extra space, redirect caches there before reinstalling:
export PIP_CACHE_DIR=/root/autodl-tmp/pip-cache
mkdir -p $PIP_CACHE_DIRIf the system disk is genuinely too small, ask the user to switch to a builder image with a larger root volume and start over.
AutoDL containers ship with regional mirrors configured. The package manager often points to mirrors.aliyun.com or similar. Failures are typically transient — retry once. If persistent:
# Quick test
curl -fsSI https://mirrors.aliyun.com/ -o /dev/null && echo OK || echo BAD
# Fall back to pypi.org / archive.ubuntu.com
sed -i '[email protected]/pypi/[email protected]/simple@g' /etc/pip.conf
sed -i '[email protected]/[email protected]/ubuntu@g' /etc/apt/sources.listDon't bake the fallback into the saved image — it'll be slow for the next user. Patch setup.sh to detect and switch instead, or just re-run.
that no patch is needed because it was transient). Otherwise the next build will hit the same problem.
setup.sh patches go into the local copy, not just the remoteone.** setup.sh is a project file (committed to the repo). After a fix, edit the local file, then write_remote_file to push it before re-run.
problems (e.g., missing CUDA libs that don't surface until first training) wastes much more time than careful verification.
image_build_abandon.On success: image_save (non-blocking) → poll image_save_status until image_status='ready' → image_build_finalize (which also releases the builder).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.