·
Last changedVersion:
This version passed the hardening gate. Hardening applied 1 targeted change and preserved all other text. Classified findings before hardening: 6. Classified findings closed: 0. Classified findings remaining: 6. Unclassified scanner findings remaining: 0. Review findings closed: 2. Review findings remaining: 18.
2
4
2
4
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Privilege Escalation & Host / Cloud Compromise | Privilege escalation | Medium | Open | |
BENCHMARK.md | Sensitive Data & Secret Exposure | Agent snooping | Medium | Open | |
SKILL.md | Malicious Code & Command Execution | — | Low | Open | |
skill-card.md | Supply Chain & Install-Time Trust | Install-time download and execute | Low | Open | |
SKILL.md | Supply Chain & Install-Time Trust | Install-time download and execute | Low | Open | |
skill-card.md | Malicious Code & Command Execution | — | Low | Open |
6 findings
You MUST NOT install, upgrade, or modify packages on the user's behalf. Provide the exact command; the user runs it. No exceptions.
Forbidden: running pip install, uv pip install, uv add,
uv sync, conda install, apt install, or any package manager.
Instead: give the exact command and ask the user to run it. Explain why the package is needed.
When a package is needed:
Even if the user says "just install it", give the command and require them to execute it themselves.
Help users install Earth2Studio and its optional model dependencies correctly for their use case. This skill handles package installation, optional-extra selection, environment variable configuration, and install verification.
You are helping a user install Earth2Studio and its optional model dependencies. Your only job is to get the package installed correctly for their use case — do not write inference code, do not compose workflows.
Earth2Studio installation commands, version tags, and extra names change between releases. Before recommending any install command, fetch the live installation docs:
Parse the page for the current version tag, available extras, and any special build notes. The workflow below is structural guidance — the specific commands come from the live page.
Use WebFetch on the install URL above. Extract:
@0.14.0)--no-build-isolation for pip,
manual pre-installs)Keep this data in working memory for all subsequent steps.
Ask (cap at 3 questions, skip what the user already answered):
Provide commands from the live docs based on their answers:
After the user runs the install, verify:
Present the available extras organized by use case. Ask what the user plans to do — don't dump all options unprompted. Categories from the docs:
| Category | Example extras |
|---|---|
Prognostic (forecasting) | aifs, aurora, graphcast, pangu, sfno, stormcast, ... |
Diagnostic (post-processing) | corrdiff, climatenet, precip-afno, ... |
Data assimilation (beta) | da-healda, da-interp, da-stormcast |
Submodules | data, perturbation, statistics |
The exact list comes from the live docs — cite those, not this table.
Ask:
--extra all)Provide the exact commands from the live docs for their selections. Key warnings to surface:
--no-build-isolation or pre-installing packages like earth2grid,
torch-harmonics, or makaniMention environment variables the user might want to set — only if relevant (e.g. limited disk, shared filesystem, CI environment):
| Variable | Purpose |
|---|---|
| General cache directory |
| Data source cache (overrides general) |
| Model checkpoint cache (overrides general) |
| Max seconds for model downloads |
If installation fails, point the user to:
Common issues:
torch.cuda.is_available() firstsudo apt-get install libeccodes-dev (Debian/Ubuntu) or
conda install -c conda-forge eccodessudo apt-get install python3-devdata extra is out of scopeOwns: package installation, optional-extra selection, environment variable configuration, install verification.
Does not own: writing inference or training code, composing
Earth2Studio workflows, data source setup beyond the data extra,
model checkpoint downloads (those happen at runtime), troubleshooting
runtime errors unrelated to missing dependencies.
Get started with chainctlchainctl skill install public/nvidia/earth2studio-install:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.chainreg.biz/public/github.com/nvidia/skills/earth2studio-install:latest
Apache-2.0
BENCHMARK.md
HARDENING.md
LICENSE
SKILL.md
evals/evals.json
skill-card.md
skill.oms.sig