How do I install the Techtide Nvidia Ngc Nim Supply Chain Governor skill?

Run npx skillmds@latest add techtideohio/techtide-nvidia-ngc-nim-supply-chain-governor in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Techtide Nvidia Ngc Nim Supply Chain Governor safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Techtide Nvidia Ngc Nim Supply Chain Governor?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Techtide Nvidia Ngc Nim Supply Chain Governor free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Techtide Nvidia Ngc Nim Supply Chain Governor?

TechTideOhio (@techtideohio) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Techtide Nvidia Ngc Nim Supply Chain Governor by techtideohio

Name: Techtide Nvidia Ngc Nim Supply Chain Governor
Author: TechTideOhio

Techtide Nvidia Ngc Nim Supply Chain Governor

Use this skill when reviewing NVIDIA NGC and NIM supply chain posture - NGC org and team boundaries, API key scope and rotation, NIM container cosign verification against NVIDIA's published identity, model card and weights provenance, AI Enterprise entitlement posture, and air-gap mirror integrity. Trigger when the user asks whether NIM images are verified before deployment, whether NGC keys are scoped per environment, or whether the deployment is procurement-defensible for a regulated tenant.

TechTideOhio Updated Sep 17, 2026

File contents

NVIDIA NGC and NIM Supply Chain Governor

Purpose

Review supply chain posture for NGC (NVIDIA GPU Cloud) registry consumption and NIM (NVIDIA Inference Microservices) deployment: NGC org/team boundaries, API key scope and rotation, NIM container signature verification, model card and weights provenance, AI Enterprise entitlement posture, and air-gap mirror integrity for sovereign deployments.

Static review only. This skill reads configuration and emits findings. It does not execute cosign verify or contact registries. For a runtime-evidence go/no-go decision on a single candidate NIM image moving staging → production, route to the live-tier counterpart techtide-nvidia-model-promotion-gatekeeper, which executes an allowlisted set of cosign/crane/oras/grype commands and emits a cosign-signable attestation JSON.

Lean operating rules

Prefer live evidence (cosign verify nvcr.io/nim/..., NGC org/team listings, key creation timestamps and scopes, AI Enterprise license metadata, mirror manifest digests) when the active client exposes it; otherwise fall back to NVIDIA NGC and NIM documentation and sanitized configuration.
Separate confirmed facts from inference. If image signature verification, key scope, or mirror integrity was not directly queried, say so.
Treat NGC API keys with org-wide write scope used in CI as a critical finding - a leaked key publishes attacker-controlled artifacts.
Treat NIM containers deployed without cosign verify (or equivalent admission policy) against NVIDIA's published identity as a high finding - image trust is unverified.
Treat NGC keys without rotation cadence and without environment scoping (prod / non-prod) as a high finding.
Treat model deployment with no model card and no weights provenance attestation as a high finding for regulated tenants - lineage cannot be reconstructed for audit.
Treat air-gap mirrors that copy by tag rather than digest as a critical finding - tags are mutable, mirror drift is silent.
Treat AI Enterprise entitlement posture that depends on a single license server with no failover as a medium finding for production.
Treat NIM model artifacts cached on local disk with world-readable permissions on shared hosts as a high finding - weight exfiltration path.

Response minimum

Return, at minimum:

the scoped target (NGC org/team, NIM image set, AI Enterprise license set) and evidence level,
NGC key scope and rotation posture,
NIM signature verification posture,
model card / weights provenance posture,
air-gap mirror integrity posture (digest-pinned vs tag-pinned),
AI Enterprise entitlement posture,
safe next actions and assumptions or blockers.

---name: techtide-nvidia-ngc-nim-supply-chain-governordescription: Use this skill when reviewing NVIDIA NGC and NIM supply chain posture - NGC org and team boundaries, API key scope and rotation, NIM container cosign verification against NVIDIA's published identity, model card and weights provenance, AI Enterprise entitlement posture, and air-gap mirror integrity. Trigger when the user asks whether NIM images are verified before deployment, whether NGC keys are scoped per environment, or whether the deployment is procurement-defensible for a regulated tenant.---# NVIDIA NGC and NIM Supply Chain Governor## PurposeReview supply chain posture for NGC (NVIDIA GPU Cloud) registry consumption and NIM (NVIDIA Inference Microservices) deployment: NGC org/team boundaries, API key scope and rotation, NIM container signature verification, model card and weights provenance, AI Enterprise entitlement posture, and air-gap mirror integrity for sovereign deployments.> **Static review only.** This skill reads configuration and emits findings. It does not execute `cosign verify` or contact registries. For a runtime-evidence go/no-go decision on a single candidate NIM image moving staging → production, route to the live-tier counterpart `techtide-nvidia-model-promotion-gatekeeper`, which executes an allowlisted set of cosign/crane/oras/grype commands and emits a cosign-signable attestation JSON.## Lean operating rules- Prefer live evidence (`cosign verify nvcr.io/nim/...`, NGC org/team listings, key creation timestamps and scopes, AI Enterprise license metadata, mirror manifest digests) when the active client exposes it; otherwise fall back to NVIDIA NGC and NIM documentation and sanitized configuration.- Separate confirmed facts from inference. If image signature verification, key scope, or mirror integrity was not directly queried, say so.- Treat NGC API keys with org-wide write scope used in CI as a critical finding - a leaked key publishes attacker-controlled artifacts.- Treat NIM containers deployed without `cosign verify` (or equivalent admission policy) against NVIDIA's published identity as a high finding - image trust is unverified.- Treat NGC keys without rotation cadence and without environment scoping (prod / non-prod) as a high finding.- Treat model deployment with no model card and no weights provenance attestation as a high finding for regulated tenants - lineage cannot be reconstructed for audit.- Treat air-gap mirrors that copy by tag rather than digest as a critical finding - tags are mutable, mirror drift is silent.- Treat AI Enterprise entitlement posture that depends on a single license server with no failover as a medium finding for production.- Treat NIM model artifacts cached on local disk with world-readable permissions on shared hosts as a high finding - weight exfiltration path.## Response minimumReturn, at minimum:- the scoped target (NGC org/team, NIM image set, AI Enterprise license set) and evidence level,- NGC key scope and rotation posture,- NIM signature verification posture,- model card / weights provenance posture,- air-gap mirror integrity posture (digest-pinned vs tag-pinned),- AI Enterprise entitlement posture,- safe next actions and assumptions or blockers.

Frequently asked questions