From 9992e32db37a020d1830a29f01a39625ecd369df Mon Sep 17 00:00:00 2001 From: Teknium <127238744+teknium1@users.noreply.github.com> Date: Thu, 28 May 2026 19:20:12 -0700 Subject: [PATCH] feat(skills): integrate NVIDIA/skills as a trusted skills hub tap MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit NVIDIA's verified skills catalog (https://github.com/NVIDIA/skills) ships NVIDIA-signed skills for CUDA-X, AIQ, cuOpt, cuPyNumeric, DeepStream, NeMo, NemoClaw and the Skill Card Generator — each bundle carrying a detached `skill.oms.sig` signature, a governance `skill-card.md`, and `evals/`. The sync pipeline drops any skill missing those artifacts before publishing. Changes: - tools/skills_hub.py: add NVIDIA/skills to GitHubSource.DEFAULT_TAPS so it lights up in `hermes skills browse`, `hermes skills search `, the twice-daily skills-index build, and the docs-site Skills Hub page (https://hermes-agent.nousresearch.com/docs/skills) automatically. - tools/skills_guard.py: add NVIDIA/skills to TRUSTED_REPOS so installs resolve to trust_level="trusted" (looser install policy than community). - website/scripts/extract-skills.py: map the `github` source id to a friendly "NVIDIA" pill label for the docs hub page. - website/src/pages/skills/index.tsx: register the NVIDIA pill (green #76b900) and slot it into SOURCE_ORDER after HuggingFace. - website/docs/user-guide/features/skills.md (+ zh-Hans i18n): document the new default tap and the expanded trusted-repos list. - tests/tools/test_skills_guard.py: assert NVIDIA/skills resolves to "trusted" (including the skills-sh-wrapped form). - tests/tools/test_skills_hub.py: invariant — every TRUSTED_REPOS entry must be reachable via GitHubSource.DEFAULT_TAPS (prevents future trusted repos from being declared but never browseable). Validation: - Live GitHub fetch: `src.fetch('NVIDIA/skills/skills/aiq-deploy')` pulled 17 files including SKILL.md (13 KB), skill-card.md, skill.oms.sig, and the full references/ + evals/ tree. trust_level="trusted". - Live inspect resolved name, description, and trust correctly. - All 193 existing skills_guard + skills_hub tests still pass. --- tests/tools/test_skills_guard.py | 8 +++++ tests/tools/test_skills_hub.py | 30 +++++++++++++++++++ tools/skills_guard.py | 11 ++++++- tools/skills_hub.py | 8 +++++ website/docs/user-guide/features/skills.md | 3 +- .../current/user-guide/features/skills.md | 3 +- website/scripts/extract-skills.py | 1 + website/src/pages/skills/index.tsx | 8 +++++ 8 files changed, 69 insertions(+), 3 deletions(-) diff --git a/tests/tools/test_skills_guard.py b/tests/tools/test_skills_guard.py index 524da52baa8..283e6aad368 100644 --- a/tests/tools/test_skills_guard.py +++ b/tests/tools/test_skills_guard.py @@ -54,6 +54,14 @@ class TestResolveTrustLevel: assert _resolve_trust_level("anthropics/skills") == "trusted" assert _resolve_trust_level("openai/skills/some-skill") == "trusted" + def test_nvidia_skills_is_trusted(self): + # NVIDIA/skills ships NVIDIA-verified skills with detached OMS + # signatures and governance skill cards. It's wired through the + # same trust path as the OpenAI / Anthropic / HuggingFace taps. + assert _resolve_trust_level("NVIDIA/skills") == "trusted" + assert _resolve_trust_level("NVIDIA/skills/aiq-deploy") == "trusted" + assert _resolve_trust_level("skills-sh/NVIDIA/skills/cuopt") == "trusted" + def test_trusted_repo_sibling_prefixes_are_not_trusted(self): assert _resolve_trust_level("openai/skills-evil") == "community" assert _resolve_trust_level("anthropics/skills-foo/frontend-design") == "community" diff --git a/tests/tools/test_skills_hub.py b/tests/tools/test_skills_hub.py index 85bd4c5e17c..74caf4845b7 100644 --- a/tests/tools/test_skills_hub.py +++ b/tests/tools/test_skills_hub.py @@ -103,6 +103,36 @@ class TestTrustLevelFor: # No path part — still resolves repo correctly assert result in {"trusted", "community"} + def test_nvidia_skills_tap_is_registered_and_trusted(self): + # Invariant: every trusted repo in TRUSTED_REPOS that we want + # browseable/searchable through `hermes skills browse` must also + # appear as a default tap on GitHubSource. Without the tap, the + # repo's skills don't show up in search results or the docs-site + # Skills Hub page even though the trust level is correct. + from tools.skills_guard import TRUSTED_REPOS + + assert "NVIDIA/skills" in TRUSTED_REPOS + tap_repos = {tap["repo"] for tap in GitHubSource.DEFAULT_TAPS} + assert "NVIDIA/skills" in tap_repos + + src = self._source() + assert src.trust_level_for("NVIDIA/skills/aiq-deploy") == "trusted" + + def test_browseable_trusted_repos_have_taps(self): + # General invariant covering all current and future trusted repos + # that publish under a single `skills/`-style path. openai/skills + # is the deliberate exception — it has two taps (`.curated/` and + # `.system/`) — so we just assert membership not path equality. + from tools.skills_guard import TRUSTED_REPOS + + tap_repos = {tap["repo"] for tap in GitHubSource.DEFAULT_TAPS} + for repo in TRUSTED_REPOS: + assert repo in tap_repos, ( + f"Trusted repo {repo!r} is in TRUSTED_REPOS but missing " + "from GitHubSource.DEFAULT_TAPS — its skills will not be " + "browsable via `hermes skills browse`." + ) + # --------------------------------------------------------------------------- # SkillsShSource diff --git a/tools/skills_guard.py b/tools/skills_guard.py index 31949d7731d..4545c918d4d 100644 --- a/tools/skills_guard.py +++ b/tools/skills_guard.py @@ -36,7 +36,16 @@ from typing import List, Tuple # Hardcoded trust configuration # --------------------------------------------------------------------------- -TRUSTED_REPOS = {"openai/skills", "anthropics/skills", "huggingface/skills"} +TRUSTED_REPOS = { + "openai/skills", + "anthropics/skills", + "huggingface/skills", + # NVIDIA-verified skills: each entry ships a signed `skill.oms.sig` + # and a governance `skill-card.md` (sync pipeline drops anything + # missing the signature or card). Catalog details: + # https://github.com/NVIDIA/skills + "NVIDIA/skills", +} INSTALL_POLICY = { # safe caution dangerous diff --git a/tools/skills_hub.py b/tools/skills_hub.py index 084494e6b70..a274ad1d7d8 100644 --- a/tools/skills_hub.py +++ b/tools/skills_hub.py @@ -401,6 +401,14 @@ class GitHubSource(SkillSource): {"repo": "openai/skills", "path": "skills/.system/"}, {"repo": "anthropics/skills", "path": "skills/"}, {"repo": "huggingface/skills", "path": "skills/"}, + # NVIDIA/skills: NVIDIA-verified skills for CUDA-X, AIQ, cuOpt, + # cuPyNumeric, DeepStream, NeMo, NemoClaw, etc. Each skill ships + # alongside a signed `skill.oms.sig`, an OMS-signed `skill-card.md` + # (governance card), and an `evals/` directory — synced daily from + # the NVIDIA product repos. Treated as `trusted` (see + # `tools/skills_guard.py::TRUSTED_REPOS`). Sample layout: + # https://github.com/NVIDIA/skills/tree/main/skills + {"repo": "NVIDIA/skills", "path": "skills/"}, {"repo": "garrytan/gstack", "path": ""}, ] diff --git a/website/docs/user-guide/features/skills.md b/website/docs/user-guide/features/skills.md index df88c1369dd..0de98f3d5b0 100644 --- a/website/docs/user-guide/features/skills.md +++ b/website/docs/user-guide/features/skills.md @@ -467,6 +467,7 @@ Default taps (browsable without any setup): - [openai/skills](https://github.com/openai/skills) - [anthropics/skills](https://github.com/anthropics/skills) - [huggingface/skills](https://github.com/huggingface/skills) +- [NVIDIA/skills](https://github.com/NVIDIA/skills) — NVIDIA-verified skills (signed `skill.oms.sig` + governance `skill-card.md`) - [garrytan/gstack](https://github.com/garrytan/gstack) - Example: @@ -577,7 +578,7 @@ Important behavior: |-------|--------|--------| | `builtin` | Ships with Hermes | Always trusted | | `official` | `optional-skills/` in the repo | Builtin trust, no third-party warning | -| `trusted` | Trusted registries/repos such as `openai/skills`, `anthropics/skills`, `huggingface/skills` | More permissive policy than community sources | +| `trusted` | Trusted registries/repos such as `openai/skills`, `anthropics/skills`, `huggingface/skills`, `NVIDIA/skills` | More permissive policy than community sources | | `community` | Everything else (`skills.sh`, well-known endpoints, custom GitHub repos, most marketplaces) | Non-dangerous findings can be overridden with `--force`; `dangerous` verdicts stay blocked | ### Update lifecycle diff --git a/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/features/skills.md b/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/features/skills.md index 7a74b20b68f..5e71afd86fb 100644 --- a/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/features/skills.md +++ b/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/user-guide/features/skills.md @@ -467,6 +467,7 @@ Hermes 可以直接从 GitHub 仓库和基于 GitHub 的 tap 安装。当你已 - [openai/skills](https://github.com/openai/skills) - [anthropics/skills](https://github.com/anthropics/skills) - [huggingface/skills](https://github.com/huggingface/skills) +- [NVIDIA/skills](https://github.com/NVIDIA/skills) — NVIDIA 官方验证的技能（带签名 `skill.oms.sig` 与治理用 `skill-card.md`） - [VoltAgent/awesome-agent-skills](https://github.com/VoltAgent/awesome-agent-skills) - [garrytan/gstack](https://github.com/garrytan/gstack) @@ -578,7 +579,7 @@ hermes skills install skills-sh/anthropics/skills/pdf --force |-------|--------|--------| | `builtin` | 随 Hermes 附带 | 始终受信任 | | `official` | 仓库中的 `optional-skills/` | 内置信任，无第三方警告 | -| `trusted` | 受信任的注册表/仓库，如 `openai/skills`、`anthropics/skills`、`huggingface/skills` | 比社区来源更宽松的策略 | +| `trusted` | 受信任的注册表/仓库，如 `openai/skills`、`anthropics/skills`、`huggingface/skills`、`NVIDIA/skills` | 比社区来源更宽松的策略 | | `community` | 其他所有来源（`skills.sh`、well-known 端点、自定义 GitHub 仓库、大多数市场） | 非危险性发现可用 `--force` 覆盖；`dangerous` 结论保持阻止 | ### 更新生命周期 diff --git a/website/scripts/extract-skills.py b/website/scripts/extract-skills.py index f72598b05af..23e6dc29375 100644 --- a/website/scripts/extract-skills.py +++ b/website/scripts/extract-skills.py @@ -95,6 +95,7 @@ GITHUB_TAP_LABELS = { "openai/skills": "OpenAI", "anthropics/skills": "Anthropic", "huggingface/skills": "HuggingFace", + "NVIDIA/skills": "NVIDIA", "VoltAgent/awesome-agent-skills": "VoltAgent", "garrytan/gstack": "gstack", "MiniMax-AI/cli": "MiniMax", diff --git a/website/src/pages/skills/index.tsx b/website/src/pages/skills/index.tsx index ea971fdaab7..9595af67e4f 100644 --- a/website/src/pages/skills/index.tsx +++ b/website/src/pages/skills/index.tsx @@ -163,6 +163,13 @@ const SOURCE_CONFIG: Record< border: "rgba(251, 191, 36, 0.2)", icon: "\u{1F917}", }, + NVIDIA: { + label: "NVIDIA", + color: "#76b900", + bg: "rgba(118, 185, 0, 0.08)", + border: "rgba(118, 185, 0, 0.25)", + icon: "\u{25B6}", + }, VoltAgent: { label: "VoltAgent", color: "#facc15", @@ -207,6 +214,7 @@ const SOURCE_ORDER = [ "Anthropic", "OpenAI", "HuggingFace", + "NVIDIA", "skills.sh", "ClawHub", "browse.sh",