·
Last changedVersion:
This version passed the hardening gate. Hardening applied 8 targeted changes and preserved all other text. Classified findings before hardening: 6. Classified findings closed: 0. Classified findings remaining: 6. Unclassified scanner findings remaining: 0. Review findings closed: 11. Review findings remaining: 11.
5
1
5
1
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Tool & MCP Manipulation | MCP configuration abuse | Medium | Open | |
SKILL.md | Supply Chain & Install-Time Trust | — | Medium | Open | |
evals/evals.json | Supply Chain & Install-Time Trust | — | Medium | Open | |
BENCHMARK.md | Sensitive Data & Secret Exposure | Agent snooping | Medium | Open | |
evals/evals.json | Excessive Agency & Rogue Autonomy | — | Medium | Open | |
SKILL.md | Prompt Injection | Third-party content as instructions | Low | Open |
6 findings
Help users discover, install, and start using NVIDIA skills that may not be installed yet. Treat this skill as a stable NVIDIA capability detector and catalog router, not as a mirror of every external skill's trigger text.
Use the live catalog for specific skill names, descriptions, and availability. Keep only stable taxonomy guidance here.
Use this skill to find the best NVIDIA skill for a product, task, or workflow. The user does not need to explicitly ask for a skill. If the request is about NVIDIA hardware, software, SDKs, drivers, setup, troubleshooting, or an NVIDIA-adjacent workflow, check whether the live catalog has a skill that could help before proceeding too far with general guidance.
Typical triggers:
Continue with this skill only when the request is plausibly related to an NVIDIA product area or taxonomy category.
Strong signals:
Read references/taxonomy-routing.md only when the request is taxonomy-only, ambiguous, or needs browse/domain mapping. For obvious product-name matches, go directly to live catalog lookup.
Implicit invocation is intentional: this skill acts as a NVIDIA capability detector and catalog router.
Do not activate for the generic software tasks in "When Not to Use this Skill" unless they also carry an NVIDIA, GPU, accelerated-computing, or distinctive NVIDIA workflow signal.
Recommending a skill is always allowed once the request is relevant. Installing
or modifying skills is not: never run an install (e.g. npx skills add) or
change agent capabilities without explicit user approval. A catalog match is
only a recommendation until the user confirms.
Stay quiet when the request is generic:
If relevance is uncertain, do not interrupt the user's main task. Mention the NVIDIA catalog only as an optional aside after answering, or ask one concise clarifying question if the choice materially changes the work.
How to Help Users Find Skills - a Discovery Workflow
This skill's first job is skill discovery. For NVIDIA-related requests, do a catalog check before using general web search, NVIDIA product docs, or general product knowledge as the main answer. Product documentation can help after the catalog check, but it is not a substitute for checking the NVIDIA skills catalog.
Catalog check means one of:
https://github.com/NVIDIA/skills/tree/main/skillshttps://build.nvidia.com/skillshttps://raw.githubusercontent.com/NVIDIA/skills/main/skills.sh.jsonUse the catalog sources:
Do not count a general web search, developer.nvidia.com product documentation, or docs.nvidia.com product documentation as the catalog check.
npx skills add unless the user approves.For a strong match that is not installed:
Use the active agent target when known:
If the agent target is unknown, omit --agent and let the CLI prompt:
After install, tell the user to restart or reload the agent if their client does not pick up newly installed skills immediately.
Do not fabricate catalog entries or guess at skill names. If catalog lookup
fails, say the catalog could not be checked and do not name a concrete slug or
emit an npx skills add ... --skill <name> install command. Offer to share the
catalog URL, retry lookup, or continue with general help.
Say that no strong NVIDIA catalog match was found, then either: 2. offer to help directly without a skill, or 3. suggest creating a new skill if the workflow is recurring.
Get started with chainctlchainctl skill install public/nvidia/nvidia-skill-finder:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.chainreg.biz/public/github.com/nvidia/plugins/nvidia-skills/skills/nvidia-skill-finder:latest
Apache-2.0
BENCHMARK.md
HARDENING.md
LICENSE
SKILL.md
agents/openai.yaml
evals/evals.json
references/taxonomy-routing.md
skill-card.md
skill.oms.sig