Trust Controls for Agent Skills

Agent skills are becoming a reusable software layer for AI agents. That makes them powerful, but it also means they need the same discipline we expect from other deployable artifacts: security review, provenance, ownership, and clear use boundaries.

This series describes the trust controls behind NVIDIA-Verified skills — agent skills that have been scanned, documented in a Skills Card, and signed before publication. The pipeline has three layers:

1. Scan the skill before installation.
2. Publish a skill card that states what the skill does and how it should be used.
3. Sign the shipped directory so users can verify that what they received matches what was reviewed.