nvidia-ngc-nim-supply-chain-governor

Use this skill when reviewing NVIDIA NGC and NIM supply chain posture — NGC org and team boundaries, API key scope and rotation, NIM container cosign verification against NVIDIA's published identity, model card and weights provenance, AI Enterprise entitlement posture, and air-gap mirror integrity. Trigger when the user asks whether NIM images are verified before deployment, whether NGC keys are scoped per environment, or whether the deployment is procurement-defensible for a regulated tenant.

Ir para a instalação

Repositório: Raishin/vanguard-frontier-agentic
Última atividade na origem: 11 de maio de 2026 às 02:05
Idioma detectado do SKILL.md: inglês
Estrelas: 18
Forks: 3

Opções de instalação

Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.

npx skills add https://github.com/Raishin/vanguard-frontier-agentic --skill nvidia-ngc-nim-supply-chain-governor

O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.

Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.

Revise os arquivos de origem

Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.

Explorador de arquivos

2 arquivos

SKILL.md

Instruções da origem · Visualização somente leitura

Voltar à pesquisa Voltar à instalação

kotlin-android-architecture

Use this skill to statically review Android app architecture correctness: ViewModel lifecycle and scoping across configuration changes, SavedStateHandle persistence across process death, lifecycle-aware Flow collection (repeatOnLifecycle/collectAsStateWithLifecycle/flowWithLifecycle), and unidirectional data flow with a single source of truth. Reads source only; it never runs or instruments the app.

2026-07-21

kotlin-android-security-privacy

Use this skill to statically review an Android app's security and privacy posture against OWASP MASVS: exported components and intent surfaces, deep-link/App Links validation, WebView exposure, cleartext traffic and network-security-config, local storage and secrets (EncryptedSharedPreferences/Keystore), backup exposure, runtime-permission minimization, and PII in logs. Reads manifest, source, and sanitized config only; it never builds, installs, or instruments an app.

2026-07-21

kotlin-library-api-abi-governance

Use this skill to statically review Kotlin library public-API evolution and binary/source compatibility for libraries consumed by both Kotlin and Java: binary-compatibility-validator .api snapshots and apiCheck gating, Explicit API mode, @JvmOverloads/@JvmStatic/@JvmName Java-facing surface shaping, and ABI-sensitive data-class and inline-function-body changes. Reads source and build configuration only; it never runs apiDump/apiCheck or publishes a release.

2026-07-21

Ver todas deste repositório

NVIDIA NGC and NIM Supply Chain Governor

Purpose

Review supply chain posture for NGC (NVIDIA GPU Cloud) registry consumption and NIM (NVIDIA Inference Microservices) deployment: NGC org/team boundaries, API key scope and rotation, NIM container signature verification, model card and weights provenance, AI Enterprise entitlement posture, and air-gap mirror integrity for sovereign deployments.

Static review only. This skill reads configuration and emits findings. It does not execute cosign verify or contact registries. For a runtime-evidence go/no-go decision on a single candidate NIM image moving staging → production, route to the live-tier counterpart nvidia-model-promotion-gatekeeper, which executes an allowlisted set of cosign/crane/oras/grype commands and emits a cosign-signable attestation JSON.

Lean operating rules

Prefer live evidence (cosign verify nvcr.io/nim/..., NGC org/team listings, key creation timestamps and scopes, AI Enterprise license metadata, mirror manifest digests) when the active client exposes it; otherwise fall back to NVIDIA NGC and NIM documentation and sanitized configuration.

Separate confirmed facts from inference. If image signature verification, key scope, or mirror integrity was not directly queried, say so.

Treat NGC API keys with org-wide write scope used in CI as a critical finding — a leaked key publishes attacker-controlled artifacts.

Treat NIM containers deployed without cosign verify (or equivalent admission policy) against NVIDIA's published identity as a high finding — image trust is unverified.

Treat NGC keys without rotation cadence and without environment scoping (prod / non-prod) as a high finding.

Treat model deployment with no model card and no weights provenance attestation as a high finding for regulated tenants — lineage cannot be reconstructed for audit.

Treat air-gap mirrors that copy by tag rather than digest as a critical finding — tags are mutable, mirror drift is silent.

Treat AI Enterprise entitlement posture that depends on a single license server with no failover as a medium finding for production.

Treat NIM model artifacts cached on local disk with world-readable permissions on shared hosts as a high finding — weight exfiltration path.

Response minimum

Return, at minimum:

the scoped target (NGC org/team, NIM image set, AI Enterprise license set) and evidence level,

NGC key scope and rotation posture,

NIM signature verification posture,

model card / weights provenance posture,

air-gap mirror integrity posture (digest-pinned vs tag-pinned),

AI Enterprise entitlement posture,

safe next actions and assumptions or blockers.