·
Last changedVersion:
This version passed the hardening gate. Hardening applied 1 targeted change and preserved all other text. Classified findings before hardening: 4. Classified findings closed: 0. Classified findings remaining: 4. Unclassified scanner findings remaining: 0. Review findings closed: 0. Review findings remaining: 16.
1
3
1
3
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
BENCHMARK.md | Sensitive Data & Secret Exposure | Agent snooping | Medium | Open | |
SKILL.md | Malicious Code & Command Execution | — | Low | Open | |
SKILL.md | Prompt Injection | Third-party content as instructions | Low | Open | |
SKILL.md | Supply Chain & Install-Time Trust | Install-time download and execute | Low | Open |
4 findings
Guide a user through downloading weather/climate data via Earth2Studio data source APIs. Identifies compatible sources by checking the lexicon, verifies variable support, and produces a working fetch script outputting an xarray DataArray.
uv pip install earth2studio or equivalent)~/.cdsapirc)You are helping a user download specific weather/climate data using Earth2Studio's data source APIs. Your job is to identify which data source(s) can provide the requested variables, verify compatibility via the lexicon system, and produce a working fetch script.
Data source APIs, available variables, and the lexicon evolve between releases. Before recommending a data source or writing a fetch script:
Live doc references (fetch only what the user's request requires):
Extract from what the user has said (ask follow-ups if needed, cap at 3 questions):
t2m, u500, z850, tp, msl). If the user uses plain language
("500 hPa geopotential height"), map it to the E2Studio name by checking
the live base.py E2STUDIO_VOCAB.Based on the request type, narrow candidates:
Analysis/reanalysis (historical state at a specific time):
Forecast (predictions from an initialization time with lead times):
Key differentiators to surface:
This is critical. Each data source has a lexicon file that defines which E2Studio variables it can provide.
To verify:
https://github.com/NVIDIA/earth2studio/blob/main/earth2studio/lexicon/<source>.py
(e.g. gfs.py, hrrr.py, cds.py, arco.py, wb2.py)VOCAB dictThe lexicon VOCAB maps Earth2Studio variable names → source-specific identifiers. If a variable key exists in the VOCAB, the source supports it.
Present the results clearly: "GFS supports t2m, u500, z850. HRRR also
supports these but is limited to North America. ARCO (ERA5) supports all
three and has data back to 1959."
Present the viable options with tradeoffs:
| Source | Variables | Coverage | Resolution | Time Range |
|---|---|---|---|---|
... | ... | ... | ... | ... |
Let the user pick. If there's one obvious choice, recommend it and ask for confirmation.
Write a Python script that uses the selected data source to fetch the requested data. The script structure depends on whether it's an analysis or forecast source.
Analysis source pattern:
Forecast source pattern:
Always fetch the specific data source's API doc page to confirm the exact constructor arguments and call signature before writing the script — they can vary (some need auth tokens, cache paths, specific parameters).
Include in the script:
print(data), data.shape, data.coords)After delivering the script, mention:
EARTH2STUDIO_CACHE)Owns: identifying data sources for a user's variable/time request, verifying variable support via lexicon, generating data fetch scripts, explaining analysis vs. forecast source differences.
Does not own: installation (earth2studio-install), model selection (earth2studio-discover), inference pipelines, custom data source creation (point to extend examples), data source authentication setup beyond what the docs describe.
Typical invocation:
The skill would:
z500, t2mDataArrayFile/DataSetFile directly| Error | Cause | Solution |
|---|---|---|
| Not in lexicon | Check lexicon; try another source |
| Time not available | Verify temporal coverage |
| Queue congestion | Retry or use ARCO for ERA5 |
| Not installed |
|
Empty DataArray | Time/var mismatch | Check datetime and variable name |
Get started with chainctlchainctl skill install public/nvidia/earth2studio-data-fetch:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.chainreg.biz/public/github.com/nvidia/skills/earth2studio-data-fetch:latest
Apache-2.0
BENCHMARK.md
HARDENING.md
LICENSE
SKILL.md
evals/evals.json
evals/targets/eval_1_target.py
evals/targets/eval_4_target.py
evals/targets/eval_7_target.py
skill-card.md
skill.oms.sig