| name | nvidia-ngc-nim-supply-chain-governor |
| description | Use this skill when reviewing NVIDIA NGC and NIM supply chain posture — NGC org and team boundaries, API key scope and rotation, NIM container cosign verification against NVIDIA's published identity, model card and weights provenance, AI Enterprise entitlement posture, and air-gap mirror integrity. Trigger when the user asks whether NIM images are verified before deployment, whether NGC keys are scoped per environment, or whether the deployment is procurement-defensible for a regulated tenant. |
| allowed-tools | Read Grep Glob |
| metadata | {"author":"github: Raishin","version":"0.1.0","updated":"2026-05-10","category":"security"} |
NVIDIA NGC and NIM Supply Chain Governor
Purpose
Review supply chain posture for NGC (NVIDIA GPU Cloud) registry consumption and NIM (NVIDIA Inference Microservices) deployment: NGC org/team boundaries, API key scope and rotation, NIM container signature verification, model card and weights provenance, AI Enterprise entitlement posture, and air-gap mirror integrity for sovereign deployments.
Static review only. This skill reads configuration and emits findings. It does not execute cosign verify or contact registries. For a runtime-evidence go/no-go decision on a single candidate NIM image moving staging → production, route to the live-tier counterpart nvidia-model-promotion-gatekeeper, which executes an allowlisted set of cosign/crane/oras/grype commands and emits a cosign-signable attestation JSON.
Lean operating rules
- Prefer live evidence (
cosign verify nvcr.io/nim/..., NGC org/team listings, key creation timestamps and scopes, AI Enterprise license metadata, mirror manifest digests) when the active client exposes it; otherwise fall back to NVIDIA NGC and NIM documentation and sanitized configuration.
- Separate confirmed facts from inference. If image signature verification, key scope, or mirror integrity was not directly queried, say so.
- Treat NGC API keys with org-wide write scope used in CI as a critical finding — a leaked key publishes attacker-controlled artifacts.
- Treat NIM containers deployed without
cosign verify (or equivalent admission policy) against NVIDIA's published identity as a high finding — image trust is unverified.
- Treat NGC keys without rotation cadence and without environment scoping (prod / non-prod) as a high finding.
- Treat model deployment with no model card and no weights provenance attestation as a high finding for regulated tenants — lineage cannot be reconstructed for audit.
- Treat air-gap mirrors that copy by tag rather than digest as a critical finding — tags are mutable, mirror drift is silent.
- Treat AI Enterprise entitlement posture that depends on a single license server with no failover as a medium finding for production.
- Treat NIM model artifacts cached on local disk with world-readable permissions on shared hosts as a high finding — weight exfiltration path.
Response minimum
Return, at minimum:
- the scoped target (NGC org/team, NIM image set, AI Enterprise license set) and evidence level,
- NGC key scope and rotation posture,
- NIM signature verification posture,
- model card / weights provenance posture,
- air-gap mirror integrity posture (digest-pinned vs tag-pinned),
- AI Enterprise entitlement posture,
- safe next actions and assumptions or blockers.
