protect-nebius-infra-details

Files (2)

• SKILL.md
• openai.yaml · agents/

SKILL.md (first lines)

# Protect Nebius Infra Details

Keep concrete live resource identifiers and names, account or tenant details,
private endpoints and object/registry URIs, and credentials out of Git and public
collaboration surfaces. Apply the rule even when a value is not itself a secret.

## Verified agent UI endpoint exception

The canonical `https://<public_ip>/` for an NPA agent may be included in local
operator output or an explicitly requested operational handoff, including a PR
handoff, only when all of these are true at disclosure time:

1. `npa agent status` reports `endpoint_disclosure_allowed=true` and
   `basic_auth_enforced=true`.
2. The authenticated UI probe succeeded and the unauthenticated root probe
   returned `401`.
3. The URL contains no username, password, query, or fragment.
4. The operator explicitly requested the endpoint for the agent in scope.

This exception does not permit `direct_url`, usernames, passwords, auth-file
contents, project/tenant/cluster/bucket identifiers, or unrelated endpoints.
Never copy the endpoint into committed source, docs, examples, tests, fixtures,
or reusable configuration. If the proof is missing or stale, keep the endpoint
in access-controlled evidence and withhold it from the handoff.

## Publication workflow

1. Treat commits, docs, reports, examples, fixtures, tests, PR or issue text, and
   live-validation handoffs as publication surfaces.
2. Store exact operational evidence only in access-controlled external
   artifacts. In repository summaries, use generic resource roles plus
   non-identifying counts, timings, measurements, and cryptographic hashes.
3. Do not copy task-scoped consent, resource inventories, private locations, or
   teardown identifiers into reusable configs. State the requirement and point
   to externally retained evidence without naming its location.
4. Scan staged content before committing:

   ```bash
   git diff --cached --no-ext-diff | \
     npa/.venv/bin/python -m npa.guardrails.confidentiality \
       --built-in-nebius-infra --stdin-source staged-diff --stdin-is-diff
   ```

5. Run gitleaks with `.gitleaks.toml` for credentials and secret-shaped values.
   Scan proposed PR or issue prose through the same built-in scanner before
   publication; pass the text on stdin and use a descriptive `--stdin-source`.
6. Inspect the complete aggregate diff, not only the newest edit. If sensitive
   values entered reachable branch history, rewrite only the authorized task
   branch and verify the offending commit is no longer an ancestor.
7. Stop publication when sanitization cannot be proven. Do not replace a live
   identifier with an invented identifier or fake private URI.

Placeholders in ordinary documentation and clearly synthetic unit fixtures are
allowed. Prefer environment-variable names or generic roles over realistic
opaque identifiers.

From nebius/nebius-physical-ai, Apache-2.0.

More from nebius/nebius-physical-ai