ng-trust-check

ng-trust-check

Portable command prompt generated from skills/vetting-outside-code-and-models/SKILL.md. Edit the skill, then run python tools/ng.py gen-commands; do not edit this file by hand.

Checks dependencies, models, APIs, SaaS tools, generated files, and vendor claims against how you will actually use them, the proof you have, the gaps, and the release impact. Use when any of these affect evidence, permissions, data, releases, or public trust. Do not use for an internal cleanup with no outside dependency, or for a does-it-work question.

Use when

• A change adds or updates a package, a model, an API, an online service, a generated file, a build service, or a data source.
• You are leaning on an outside claim as proof of behavior, security, privacy, reliability, licensing, or release readiness.
• A tool gets credentials, network access, data access, or a say in releases.

Do not use when

• The dependency is for development only, easy to undo, and already covered by a quick proof.
• The request is only to cite a public source, not to lean on it as trust evidence.
• A qualified security or purchasing review is needed, which happens outside this repo.

Inputs

• The dependency, model, API, or tool: its name, version, provider, intended use, which controlled items it touches, and the critical characteristics your use relies on.
• The vendor or source claims, the evidence you saw yourself, the backup controls, and what would force a re-check.
• The effects on data, credentials, permissions, the build, the release, and public claims.

Prompt text

Check Nuclear-grade dependency/model/API trust.

Inputs:
- packet:
- external item:
- provider/source:
- version/model/API surface:
- intended use:
- critical characteristics your use relies on:
- consequence if wrong/unavailable/compromised/changed:
- data/credential/permission/network impact:
- vendor/source claims:
- acceptance method per characteristic + repo-observed evidence + who verified:
- compensating controls:
- revalidation trigger:

Keep the outside claims separate from your local evidence. Return a decision for how you intend to use it, the critical characteristics and the acceptance method that verified each, the gaps (a characteristic you cannot verify blocks acceptance), the controls that make up for them, the effect on the release, and whether to ship, defer, block, or require a qualified review.