NAT
v1.0.0NVIDIA NeMo Agent Toolkit (NAT) — install, create workflows, add tools, run agents, evaluate performance, and publish as A2A/MCP servers. Use when: (1) insta...
⭐ 0· 34·0 current·0 all-time
bySaurav@sauravdev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description, the required binaries (nat, pip, uv), and the primary credential (NVIDIA_API_KEY) are consistent with installing and using the NVIDIA NeMo Agent Toolkit. Examples referencing S3, OpenAI, Bedrock, etc., are plausible optional integrations for this toolkit rather than unexplained or unrelated demands.
Instruction Scope
SKILL.md stays on-topic: install, configure, run workflows, create custom tools, and publish A2A/MCP servers. It does instruct the user to start network services (nat a2a serve) and to place credentials into workflow YAMLs (e.g., ${S3_ACCESS_KEY}), so workflows can cause the agent to access external networks and third-party services. This is expected for an agent toolkit but is a material operational/privacy consideration.
Install Mechanism
Instruction-only skill (no install spec) that recommends standard pip installs (via 'uv pip install' or 'pip install'). No unusual download URLs or archive extraction are present in the provided docs.
Credentials
The skill declares NVIDIA_API_KEY as primaryEnv which matches NIM usage. However the documentation shows many optional integrations (S3 access_key/secret, OpenAI/Azure/Bedrock keys, NAT_PUBLIC_BASE_URL, etc.). Those are not required by default but will be needed if you enable corresponding components—review any workflow configs for embedded secrets and be cautious about using broad credentials.
Persistence & Privilege
Skill is not marked always:true and is user-invocable; it does not request persistent system-wide privileges or modify other skills' configurations in the docs. Running A2A servers will open network endpoints by design, which is a normal capability for this toolkit.
Assessment
This skill appears to be what it claims: documentation for NVIDIA's NeMo Agent Toolkit. Before installing or running workflows, review any workflow YAMLs and example configs for embedded secrets (S3 keys, OpenAI/Azure keys, NAT_PUBLIC_BASE_URL) and avoid putting long-lived credentials into public configs. If you publish an A2A agent (nat a2a serve), understand you are opening an HTTP endpoint—use authentication and limit network exposure. When installing packages via pip, prefer official releases (GitHub/NVIDIA docs) and inspect any third-party example code you copy (custom tools can run arbitrary Python and use boto3/requests). If you need a higher-assurance review, provide the specific workflow YAMLs or example code you plan to run so those can be checked for secret leakage or unexpected network destinations.Like a lobster shell, security has layers — review code before you run it.
latestvk97ekmh7sfh4cr0frqcr419q4h844fmr
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Any binnat, pip, uv
Primary envNVIDIA_API_KEY