nvidia-ngc-nim-supply-chain-governor

Use this skill when reviewing NVIDIA NGC and NIM supply chain posture — NGC org and team boundaries, API key scope and rotation, NIM container cosign verification against NVIDIA's published identity, model card and weights provenance, AI Enterprise entitlement posture, and air-gap mirror integrity. Trigger when the user asks whether NIM images are verified before deployment, whether NGC keys are scoped per environment, or whether the deployment is procurement-defensible for a regulated tenant.

Jump to install

Repository: Raishin/vanguard-frontier-agentic
Last source activity: May 11, 2026 at 02:05
Detected SKILL.md language: English
Stars: 18
Forks: 3

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/Raishin/vanguard-frontier-agentic --skill nvidia-ngc-nim-supply-chain-governor

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

2 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

kotlin-android-architecture

Use this skill to statically review Android app architecture correctness: ViewModel lifecycle and scoping across configuration changes, SavedStateHandle persistence across process death, lifecycle-aware Flow collection (repeatOnLifecycle/collectAsStateWithLifecycle/flowWithLifecycle), and unidirectional data flow with a single source of truth. Reads source only; it never runs or instruments the app.

2026-07-21

kotlin-android-security-privacy

Use this skill to statically review an Android app's security and privacy posture against OWASP MASVS: exported components and intent surfaces, deep-link/App Links validation, WebView exposure, cleartext traffic and network-security-config, local storage and secrets (EncryptedSharedPreferences/Keystore), backup exposure, runtime-permission minimization, and PII in logs. Reads manifest, source, and sanitized config only; it never builds, installs, or instruments an app.

2026-07-21

kotlin-library-api-abi-governance

Use this skill to statically review Kotlin library public-API evolution and binary/source compatibility for libraries consumed by both Kotlin and Java: binary-compatibility-validator .api snapshots and apiCheck gating, Explicit API mode, @JvmOverloads/@JvmStatic/@JvmName Java-facing surface shaping, and ABI-sensitive data-class and inline-function-body changes. Reads source and build configuration only; it never runs apiDump/apiCheck or publishes a release.

2026-07-21

View all from this repository

NVIDIA NGC and NIM Supply Chain Governor

Purpose

Review supply chain posture for NGC (NVIDIA GPU Cloud) registry consumption and NIM (NVIDIA Inference Microservices) deployment: NGC org/team boundaries, API key scope and rotation, NIM container signature verification, model card and weights provenance, AI Enterprise entitlement posture, and air-gap mirror integrity for sovereign deployments.

Static review only. This skill reads configuration and emits findings. It does not execute cosign verify or contact registries. For a runtime-evidence go/no-go decision on a single candidate NIM image moving staging → production, route to the live-tier counterpart nvidia-model-promotion-gatekeeper, which executes an allowlisted set of cosign/crane/oras/grype commands and emits a cosign-signable attestation JSON.

Lean operating rules

Prefer live evidence (cosign verify nvcr.io/nim/..., NGC org/team listings, key creation timestamps and scopes, AI Enterprise license metadata, mirror manifest digests) when the active client exposes it; otherwise fall back to NVIDIA NGC and NIM documentation and sanitized configuration.

Separate confirmed facts from inference. If image signature verification, key scope, or mirror integrity was not directly queried, say so.

Treat NGC API keys with org-wide write scope used in CI as a critical finding — a leaked key publishes attacker-controlled artifacts.

Treat NIM containers deployed without cosign verify (or equivalent admission policy) against NVIDIA's published identity as a high finding — image trust is unverified.

Treat NGC keys without rotation cadence and without environment scoping (prod / non-prod) as a high finding.

Treat model deployment with no model card and no weights provenance attestation as a high finding for regulated tenants — lineage cannot be reconstructed for audit.

Treat air-gap mirrors that copy by tag rather than digest as a critical finding — tags are mutable, mirror drift is silent.

Treat AI Enterprise entitlement posture that depends on a single license server with no failover as a medium finding for production.

Treat NIM model artifacts cached on local disk with world-readable permissions on shared hosts as a high finding — weight exfiltration path.

Response minimum

Return, at minimum:

the scoped target (NGC org/team, NIM image set, AI Enterprise license set) and evidence level,

NGC key scope and rotation posture,

NIM signature verification posture,

model card / weights provenance posture,

air-gap mirror integrity posture (digest-pinned vs tag-pinned),

AI Enterprise entitlement posture,

safe next actions and assumptions or blockers.