From 11b5ace9c830f8761aa9827761cf324fbb4092e2 Mon Sep 17 00:00:00 2001
From: Ohad Mosafi <omosafi@nvidia.com>
Date: Wed, 30 Sep 2026 13:00:31 -0700
Subject: [PATCH 1/3] Sign openfold3 nim

Signed-off-by: Ohad Mosafi <omosafi@nvidia.com>
---
 nim-skills/openfold3-nim/SKILL.md             |   2 +-
 nim-skills/openfold3-nim/evals/evals.json     | 144 +++---------------
 .../skills/openfold3-nim/SKILL.md             |   2 +-
 .../skills/openfold3-nim/evals/evals.json     | 144 +++---------------
 4 files changed, 50 insertions(+), 242 deletions(-)

diff --git a/nim-skills/openfold3-nim/SKILL.md b/nim-skills/openfold3-nim/SKILL.md
index c1b2866..87bd8c6 100644
--- a/nim-skills/openfold3-nim/SKILL.md
+++ b/nim-skills/openfold3-nim/SKILL.md
@@ -10,7 +10,7 @@ allowed-tools: Bash, Read, Write, AskUserQuestion
 # OpenFold3 NIM
 
 Predict biomolecular structures with OpenFold3. It supports proteins, DNA, RNA,
-small-molecule ligands, and multi-entity assemblies. Use this `SKILL.md` for
+small-molecule ligands, and multi-entity assemblies. Use this guide for
 basic hosted/local NIM use; load supplemental files only when the task needs
 deeper context:
 
diff --git a/nim-skills/openfold3-nim/evals/evals.json b/nim-skills/openfold3-nim/evals/evals.json
index a2fbeaa..044735c 100644
--- a/nim-skills/openfold3-nim/evals/evals.json
+++ b/nim-skills/openfold3-nim/evals/evals.json
@@ -7,36 +7,12 @@
       "expected_output": "A Python script that calls the hosted OpenFold3 endpoint with Bearer auth, constructs an inputs payload with the peptide sequence as a protein molecule type including a minimal MSA, saves the returned structure to a PDB or CIF file, and prints the confidence scores.",
       "files": [],
       "assertions": [
-        {
-          "id": "hosted-endpoint-url",
-          "description": "Uses the correct hosted OpenFold3 endpoint URL",
-          "check": "Script contains 'health.api.nvidia.com/v1/biology/openfold/openfold3/predict'"
-        },
-        {
-          "id": "bearer-auth-header",
-          "description": "Sets Authorization header with Bearer token from NGC_API_KEY",
-          "check": "Script contains 'Authorization' and 'Bearer' and 'NGC_API_KEY'"
-        },
-        {
-          "id": "inputs-array-structure",
-          "description": "Payload uses 'inputs' array containing molecule objects",
-          "check": "Script payload contains 'inputs' key with an array/list containing 'molecules'"
-        },
-        {
-          "id": "molecule-type-protein",
-          "description": "Molecule object sets type to 'protein'",
-          "check": "Script contains 'type' and 'protein' in the molecule specification"
-        },
-        {
-          "id": "msa-structure",
-          "description": "MSA field is provided with nested alignment structure",
-          "check": "Script contains 'msa' with an alignment string starting with '>query'"
-        },
-        {
-          "id": "saves-structure-output",
-          "description": "Saves the returned structure to a file and prints confidence scores",
-          "check": "Script writes structure content to a file and references 'confidence_score' or 'structures_with_scores' from the response"
-        }
+        "[hosted-endpoint-url] Uses the correct hosted OpenFold3 endpoint URL: Script contains 'health.api.nvidia.com/v1/biology/openfold/openfold3/predict'",
+        "[bearer-auth-header] Sets Authorization header with Bearer token from NGC_API_KEY: Script contains 'Authorization' and 'Bearer' and 'NGC_API_KEY'",
+        "[inputs-array-structure] Payload uses 'inputs' array containing molecule objects: Script payload contains 'inputs' key with an array/list containing 'molecules'",
+        "[molecule-type-protein] Molecule object sets type to 'protein': Script contains 'type' and 'protein' in the molecule specification",
+        "[msa-structure] MSA field is provided with nested alignment structure: Script contains 'msa' with an alignment string starting with '>query'",
+        "[saves-structure-output] Saves the returned structure to a file and prints confidence scores: Script writes structure content to a file and references 'confidence_score' or 'structures_with_scores' from the response"
       ]
     },
     {
@@ -45,36 +21,12 @@
       "expected_output": "A Python script with two molecules in the payload — a protein with sequence and MSA, and a ligand using ccd_codes set to ATP — calling the hosted endpoint, saving structure output, and printing pLDDT and confidence scores.",
       "files": [],
       "assertions": [
-        {
-          "id": "hosted-endpoint-url",
-          "description": "Uses the correct hosted endpoint URL",
-          "check": "Script contains 'health.api.nvidia.com/v1/biology/openfold/openfold3/predict'"
-        },
-        {
-          "id": "two-molecules",
-          "description": "Payload includes both a protein molecule and a ligand molecule",
-          "check": "Script payload contains both 'type' set to 'protein' and 'type' set to 'ligand' in two separate molecule objects"
-        },
-        {
-          "id": "ccd-codes-field",
-          "description": "Ligand uses ccd_codes field set to ATP",
-          "check": "Script contains 'ccd_codes' and 'ATP'"
-        },
-        {
-          "id": "protein-sequence-present",
-          "description": "The provided protein sequence appears in the payload",
-          "check": "Script contains 'MTEYKLVVVGACGVGKSALTIQLIQNHFVDEYDPTIEDSYRKQVVID'"
-        },
-        {
-          "id": "confidence-scores-reported",
-          "description": "Prints or displays confidence score and pLDDT from response",
-          "check": "Script references 'confidence_score' and 'complex_plddt_score' or 'plddt' from the response"
-        },
-        {
-          "id": "saves-output-file",
-          "description": "Saves the predicted structure to a PDB or CIF file",
-          "check": "Script writes structure content to a file with .pdb or .cif extension"
-        }
+        "[hosted-endpoint-url] Uses the correct hosted endpoint URL: Script contains 'health.api.nvidia.com/v1/biology/openfold/openfold3/predict'",
+        "[two-molecules] Payload includes both a protein molecule and a ligand molecule: Script payload contains both 'type' set to 'protein' and 'type' set to 'ligand' in two separate molecule objects",
+        "[ccd-codes-field] Ligand uses ccd_codes field set to ATP: Script contains 'ccd_codes' and 'ATP'",
+        "[protein-sequence-present] The provided protein sequence appears in the payload: Script contains 'MTEYKLVVVGACGVGKSALTIQLIQNHFVDEYDPTIEDSYRKQVVID'",
+        "[confidence-scores-reported] Prints or displays confidence score and pLDDT from response: Script references 'confidence_score' and 'complex_plddt_score' or 'plddt' from the response",
+        "[saves-output-file] Saves the predicted structure to a PDB or CIF file: Script writes structure content to a file with .pdb or .cif extension"
       ]
     },
     {
@@ -83,36 +35,12 @@
       "expected_output": "Docker setup commands using shell env first and optional repo-root .env overrides, requiring NGC_API_KEY or NVIDIA_API_KEY fallback plus LOCAL_NIM_CACHE, running with --gpus 'device=0', --shm-size=16g, and the correct cache mount path, then a health check loop and no-auth prediction script targeting localhost:8000.",
       "files": [],
       "assertions": [
-        {
-          "id": "docker-login-nvcr",
-          "description": "Includes docker login command for nvcr.io with oauthtoken",
-          "check": "Output contains 'docker login nvcr.io' and 'oauthtoken'"
-        },
-        {
-          "id": "docker-image-tag",
-          "description": "References the correct OpenFold3 container image",
-          "check": "Output contains 'nvcr.io/nim/openfold/openfold3'"
-        },
-        {
-          "id": "single-gpu-flag",
-          "description": "Uses single GPU device specification",
-          "check": "Output contains '--gpus' and 'device=0'"
-        },
-        {
-          "id": "shm-size-flag",
-          "description": "Includes --shm-size flag (required for this NIM)",
-          "check": "Output contains '--shm-size' and '16'"
-        },
-        {
-          "id": "env-contract-and-cache",
-          "description": "Local setup uses the repo env contract and LOCAL_NIM_CACHE",
-          "check": "Output sources repo-root .env only if present, supports NVIDIA_API_KEY fallback to NGC_API_KEY, requires LOCAL_NIM_CACHE, and mounts LOCAL_NIM_CACHE to /opt/nim/.cache"
-        },
-        {
-          "id": "local-endpoint-url",
-          "description": "Prediction script targets localhost:8000 without /v1/ prefix",
-          "check": "Script contains 'localhost:8000/biology/openfold/openfold3/predict'"
-        }
+        "[docker-login-nvcr] Includes docker login command for nvcr.io with oauthtoken: Output contains 'docker login nvcr.io' and 'oauthtoken'",
+        "[docker-image-tag] References the correct OpenFold3 container image: Output contains 'nvcr.io/nim/openfold/openfold3'",
+        "[single-gpu-flag] Uses single GPU device specification: Output contains '--gpus' and 'device=0'",
+        "[shm-size-flag] Includes --shm-size flag (required for this NIM): Output contains '--shm-size' and '16'",
+        "[env-contract-and-cache] Local setup uses the repo env contract and LOCAL_NIM_CACHE: Output sources repo-root .env only if present, supports NVIDIA_API_KEY fallback to NGC_API_KEY, requires LOCAL_NIM_CACHE, and mounts LOCAL_NIM_CACHE to /opt/nim/.cache",
+        "[local-endpoint-url] Prediction script targets localhost:8000 without /v1/ prefix: Script contains 'localhost:8000/biology/openfold/openfold3/predict'"
       ]
     },
     {
@@ -121,36 +49,12 @@
       "expected_output": "A Python script with three molecules in the payload (protein + two DNA chains), diffusion_samples set to 2, output_format set to 'cif', using the hosted endpoint. Saves and names the returned CIF files and prints per-sample confidence scores.",
       "files": [],
       "assertions": [
-        {
-          "id": "hosted-endpoint-url",
-          "description": "Uses the correct hosted endpoint URL",
-          "check": "Script contains 'health.api.nvidia.com/v1/biology/openfold/openfold3/predict'"
-        },
-        {
-          "id": "protein-and-dna-molecules",
-          "description": "Payload contains one protein molecule and two DNA molecules",
-          "check": "Script contains 'type' set to 'protein' and 'type' set to 'dna' in the molecules list"
-        },
-        {
-          "id": "dna-sequences-present",
-          "description": "Both DNA sequences appear in the payload",
-          "check": "Script contains 'ATCGATCGATCG' and 'CGATCGATCGAT'"
-        },
-        {
-          "id": "diffusion-samples",
-          "description": "diffusion_samples is set to 2",
-          "check": "Script contains 'diffusion_samples' and '2'"
-        },
-        {
-          "id": "cif-output-format",
-          "description": "output_format is set to 'cif'",
-          "check": "Script contains 'output_format' and 'cif'"
-        },
-        {
-          "id": "multiple-structures-saved",
-          "description": "Script iterates over structures_with_scores to save each sample",
-          "check": "Script iterates over the response structures and saves each to a separate .cif file"
-        }
+        "[hosted-endpoint-url] Uses the correct hosted endpoint URL: Script contains 'health.api.nvidia.com/v1/biology/openfold/openfold3/predict'",
+        "[protein-and-dna-molecules] Payload contains one protein molecule and two DNA molecules: Script contains 'type' set to 'protein' and 'type' set to 'dna' in the molecules list",
+        "[dna-sequences-present] Both DNA sequences appear in the payload: Script contains 'ATCGATCGATCG' and 'CGATCGATCGAT'",
+        "[diffusion-samples] diffusion_samples is set to 2: Script contains 'diffusion_samples' and '2'",
+        "[cif-output-format] output_format is set to 'cif': Script contains 'output_format' and 'cif'",
+        "[multiple-structures-saved] Script iterates over structures_with_scores to save each sample: Script iterates over the response structures and saves each to a separate .cif file"
       ]
     }
   ]
diff --git a/skills/bionemo-agent-toolkit/skills/openfold3-nim/SKILL.md b/skills/bionemo-agent-toolkit/skills/openfold3-nim/SKILL.md
index c1b2866..87bd8c6 100644
--- a/skills/bionemo-agent-toolkit/skills/openfold3-nim/SKILL.md
+++ b/skills/bionemo-agent-toolkit/skills/openfold3-nim/SKILL.md
@@ -10,7 +10,7 @@ allowed-tools: Bash, Read, Write, AskUserQuestion
 # OpenFold3 NIM
 
 Predict biomolecular structures with OpenFold3. It supports proteins, DNA, RNA,
-small-molecule ligands, and multi-entity assemblies. Use this `SKILL.md` for
+small-molecule ligands, and multi-entity assemblies. Use this guide for
 basic hosted/local NIM use; load supplemental files only when the task needs
 deeper context:
 
diff --git a/skills/bionemo-agent-toolkit/skills/openfold3-nim/evals/evals.json b/skills/bionemo-agent-toolkit/skills/openfold3-nim/evals/evals.json
index a2fbeaa..044735c 100644
--- a/skills/bionemo-agent-toolkit/skills/openfold3-nim/evals/evals.json
+++ b/skills/bionemo-agent-toolkit/skills/openfold3-nim/evals/evals.json
@@ -7,36 +7,12 @@
       "expected_output": "A Python script that calls the hosted OpenFold3 endpoint with Bearer auth, constructs an inputs payload with the peptide sequence as a protein molecule type including a minimal MSA, saves the returned structure to a PDB or CIF file, and prints the confidence scores.",
       "files": [],
       "assertions": [
-        {
-          "id": "hosted-endpoint-url",
-          "description": "Uses the correct hosted OpenFold3 endpoint URL",
-          "check": "Script contains 'health.api.nvidia.com/v1/biology/openfold/openfold3/predict'"
-        },
-        {
-          "id": "bearer-auth-header",
-          "description": "Sets Authorization header with Bearer token from NGC_API_KEY",
-          "check": "Script contains 'Authorization' and 'Bearer' and 'NGC_API_KEY'"
-        },
-        {
-          "id": "inputs-array-structure",
-          "description": "Payload uses 'inputs' array containing molecule objects",
-          "check": "Script payload contains 'inputs' key with an array/list containing 'molecules'"
-        },
-        {
-          "id": "molecule-type-protein",
-          "description": "Molecule object sets type to 'protein'",
-          "check": "Script contains 'type' and 'protein' in the molecule specification"
-        },
-        {
-          "id": "msa-structure",
-          "description": "MSA field is provided with nested alignment structure",
-          "check": "Script contains 'msa' with an alignment string starting with '>query'"
-        },
-        {
-          "id": "saves-structure-output",
-          "description": "Saves the returned structure to a file and prints confidence scores",
-          "check": "Script writes structure content to a file and references 'confidence_score' or 'structures_with_scores' from the response"
-        }
+        "[hosted-endpoint-url] Uses the correct hosted OpenFold3 endpoint URL: Script contains 'health.api.nvidia.com/v1/biology/openfold/openfold3/predict'",
+        "[bearer-auth-header] Sets Authorization header with Bearer token from NGC_API_KEY: Script contains 'Authorization' and 'Bearer' and 'NGC_API_KEY'",
+        "[inputs-array-structure] Payload uses 'inputs' array containing molecule objects: Script payload contains 'inputs' key with an array/list containing 'molecules'",
+        "[molecule-type-protein] Molecule object sets type to 'protein': Script contains 'type' and 'protein' in the molecule specification",
+        "[msa-structure] MSA field is provided with nested alignment structure: Script contains 'msa' with an alignment string starting with '>query'",
+        "[saves-structure-output] Saves the returned structure to a file and prints confidence scores: Script writes structure content to a file and references 'confidence_score' or 'structures_with_scores' from the response"
       ]
     },
     {
@@ -45,36 +21,12 @@
       "expected_output": "A Python script with two molecules in the payload — a protein with sequence and MSA, and a ligand using ccd_codes set to ATP — calling the hosted endpoint, saving structure output, and printing pLDDT and confidence scores.",
       "files": [],
       "assertions": [
-        {
-          "id": "hosted-endpoint-url",
-          "description": "Uses the correct hosted endpoint URL",
-          "check": "Script contains 'health.api.nvidia.com/v1/biology/openfold/openfold3/predict'"
-        },
-        {
-          "id": "two-molecules",
-          "description": "Payload includes both a protein molecule and a ligand molecule",
-          "check": "Script payload contains both 'type' set to 'protein' and 'type' set to 'ligand' in two separate molecule objects"
-        },
-        {
-          "id": "ccd-codes-field",
-          "description": "Ligand uses ccd_codes field set to ATP",
-          "check": "Script contains 'ccd_codes' and 'ATP'"
-        },
-        {
-          "id": "protein-sequence-present",
-          "description": "The provided protein sequence appears in the payload",
-          "check": "Script contains 'MTEYKLVVVGACGVGKSALTIQLIQNHFVDEYDPTIEDSYRKQVVID'"
-        },
-        {
-          "id": "confidence-scores-reported",
-          "description": "Prints or displays confidence score and pLDDT from response",
-          "check": "Script references 'confidence_score' and 'complex_plddt_score' or 'plddt' from the response"
-        },
-        {
-          "id": "saves-output-file",
-          "description": "Saves the predicted structure to a PDB or CIF file",
-          "check": "Script writes structure content to a file with .pdb or .cif extension"
-        }
+        "[hosted-endpoint-url] Uses the correct hosted endpoint URL: Script contains 'health.api.nvidia.com/v1/biology/openfold/openfold3/predict'",
+        "[two-molecules] Payload includes both a protein molecule and a ligand molecule: Script payload contains both 'type' set to 'protein' and 'type' set to 'ligand' in two separate molecule objects",
+        "[ccd-codes-field] Ligand uses ccd_codes field set to ATP: Script contains 'ccd_codes' and 'ATP'",
+        "[protein-sequence-present] The provided protein sequence appears in the payload: Script contains 'MTEYKLVVVGACGVGKSALTIQLIQNHFVDEYDPTIEDSYRKQVVID'",
+        "[confidence-scores-reported] Prints or displays confidence score and pLDDT from response: Script references 'confidence_score' and 'complex_plddt_score' or 'plddt' from the response",
+        "[saves-output-file] Saves the predicted structure to a PDB or CIF file: Script writes structure content to a file with .pdb or .cif extension"
       ]
     },
     {
@@ -83,36 +35,12 @@
       "expected_output": "Docker setup commands using shell env first and optional repo-root .env overrides, requiring NGC_API_KEY or NVIDIA_API_KEY fallback plus LOCAL_NIM_CACHE, running with --gpus 'device=0', --shm-size=16g, and the correct cache mount path, then a health check loop and no-auth prediction script targeting localhost:8000.",
       "files": [],
       "assertions": [
-        {
-          "id": "docker-login-nvcr",
-          "description": "Includes docker login command for nvcr.io with oauthtoken",
-          "check": "Output contains 'docker login nvcr.io' and 'oauthtoken'"
-        },
-        {
-          "id": "docker-image-tag",
-          "description": "References the correct OpenFold3 container image",
-          "check": "Output contains 'nvcr.io/nim/openfold/openfold3'"
-        },
-        {
-          "id": "single-gpu-flag",
-          "description": "Uses single GPU device specification",
-          "check": "Output contains '--gpus' and 'device=0'"
-        },
-        {
-          "id": "shm-size-flag",
-          "description": "Includes --shm-size flag (required for this NIM)",
-          "check": "Output contains '--shm-size' and '16'"
-        },
-        {
-          "id": "env-contract-and-cache",
-          "description": "Local setup uses the repo env contract and LOCAL_NIM_CACHE",
-          "check": "Output sources repo-root .env only if present, supports NVIDIA_API_KEY fallback to NGC_API_KEY, requires LOCAL_NIM_CACHE, and mounts LOCAL_NIM_CACHE to /opt/nim/.cache"
-        },
-        {
-          "id": "local-endpoint-url",
-          "description": "Prediction script targets localhost:8000 without /v1/ prefix",
-          "check": "Script contains 'localhost:8000/biology/openfold/openfold3/predict'"
-        }
+        "[docker-login-nvcr] Includes docker login command for nvcr.io with oauthtoken: Output contains 'docker login nvcr.io' and 'oauthtoken'",
+        "[docker-image-tag] References the correct OpenFold3 container image: Output contains 'nvcr.io/nim/openfold/openfold3'",
+        "[single-gpu-flag] Uses single GPU device specification: Output contains '--gpus' and 'device=0'",
+        "[shm-size-flag] Includes --shm-size flag (required for this NIM): Output contains '--shm-size' and '16'",
+        "[env-contract-and-cache] Local setup uses the repo env contract and LOCAL_NIM_CACHE: Output sources repo-root .env only if present, supports NVIDIA_API_KEY fallback to NGC_API_KEY, requires LOCAL_NIM_CACHE, and mounts LOCAL_NIM_CACHE to /opt/nim/.cache",
+        "[local-endpoint-url] Prediction script targets localhost:8000 without /v1/ prefix: Script contains 'localhost:8000/biology/openfold/openfold3/predict'"
       ]
     },
     {
@@ -121,36 +49,12 @@
       "expected_output": "A Python script with three molecules in the payload (protein + two DNA chains), diffusion_samples set to 2, output_format set to 'cif', using the hosted endpoint. Saves and names the returned CIF files and prints per-sample confidence scores.",
       "files": [],
       "assertions": [
-        {
-          "id": "hosted-endpoint-url",
-          "description": "Uses the correct hosted endpoint URL",
-          "check": "Script contains 'health.api.nvidia.com/v1/biology/openfold/openfold3/predict'"
-        },
-        {
-          "id": "protein-and-dna-molecules",
-          "description": "Payload contains one protein molecule and two DNA molecules",
-          "check": "Script contains 'type' set to 'protein' and 'type' set to 'dna' in the molecules list"
-        },
-        {
-          "id": "dna-sequences-present",
-          "description": "Both DNA sequences appear in the payload",
-          "check": "Script contains 'ATCGATCGATCG' and 'CGATCGATCGAT'"
-        },
-        {
-          "id": "diffusion-samples",
-          "description": "diffusion_samples is set to 2",
-          "check": "Script contains 'diffusion_samples' and '2'"
-        },
-        {
-          "id": "cif-output-format",
-          "description": "output_format is set to 'cif'",
-          "check": "Script contains 'output_format' and 'cif'"
-        },
-        {
-          "id": "multiple-structures-saved",
-          "description": "Script iterates over structures_with_scores to save each sample",
-          "check": "Script iterates over the response structures and saves each to a separate .cif file"
-        }
+        "[hosted-endpoint-url] Uses the correct hosted endpoint URL: Script contains 'health.api.nvidia.com/v1/biology/openfold/openfold3/predict'",
+        "[protein-and-dna-molecules] Payload contains one protein molecule and two DNA molecules: Script contains 'type' set to 'protein' and 'type' set to 'dna' in the molecules list",
+        "[dna-sequences-present] Both DNA sequences appear in the payload: Script contains 'ATCGATCGATCG' and 'CGATCGATCGAT'",
+        "[diffusion-samples] diffusion_samples is set to 2: Script contains 'diffusion_samples' and '2'",
+        "[cif-output-format] output_format is set to 'cif': Script contains 'output_format' and 'cif'",
+        "[multiple-structures-saved] Script iterates over structures_with_scores to save each sample: Script iterates over the response structures and saves each to a separate .cif file"
       ]
     }
   ]

From 243b1ed2295c9372fe5caec7e1a8ea042242f2e0 Mon Sep 17 00:00:00 2001
From: Ohad Mosafi <omosafi@nvidia.com>
Date: Wed, 30 Sep 2026 13:23:27 -0700
Subject: [PATCH 2/3] Fix OpenFold3 credential handling and Docker startup

Signed-off-by: Ohad Mosafi <omosafi@nvidia.com>
---
 nim-skills/openfold3-nim/SKILL.md             | 33 ++++++++++--------
 .../config/skillspector-baseline.yml          | 34 ++++---------------
 nim-skills/openfold3-nim/evals/evals.json     |  8 +++--
 nim-skills/openfold3-nim/references/api.md    | 24 ++++++++-----
 .../skills/openfold3-nim/SKILL.md             | 33 ++++++++++--------
 .../config/skillspector-baseline.yml          | 34 ++++---------------
 .../skills/openfold3-nim/evals/evals.json     |  8 +++--
 .../skills/openfold3-nim/references/api.md    | 24 ++++++++-----
 8 files changed, 90 insertions(+), 108 deletions(-)

diff --git a/nim-skills/openfold3-nim/SKILL.md b/nim-skills/openfold3-nim/SKILL.md
index 87bd8c6..c627c99 100644
--- a/nim-skills/openfold3-nim/SKILL.md
+++ b/nim-skills/openfold3-nim/SKILL.md
@@ -11,14 +11,14 @@ allowed-tools: Bash, Read, Write, AskUserQuestion
 
 Predict biomolecular structures with OpenFold3. It supports proteins, DNA, RNA,
 small-molecule ligands, and multi-entity assemblies. Use this guide for
-basic hosted/local NIM use; load supplemental files only when the task needs
+basic hosted and local NIM use; load supplemental files only when the task needs
 deeper context:
 
 - `references/api.md`: exact endpoints, schemas, Docker flags, response fields.
 - `references/science.md`: purpose, strengths, limitations, and model handoffs.
 - `references/parameters.md`: molecule fields, MSAs, templates, samples, tuning.
 - `references/validation.md`: artifact checks and scientific sanity checks.
-- `references/examples.md`: compact hosted/local request patterns.
+- `references/examples.md`: compact hosted and local request patterns.
 
 ## Choose Mode
 
@@ -34,22 +34,26 @@ Mode difference: the local prediction path has no `/v1/` prefix. Hosted requests
 startup uses `NGC_API_KEY` (or `NVIDIA_API_KEY` via the preflight) for
 registry login, entitlement checks, and first-run model downloads; pass it
 into the container with `-e NGC_API_KEY`. Local inference requests use no
-auth header after readiness. Warm-cache key-free startup varies by
-image/version and should not be assumed.
+auth header after readiness, so bind the host port to loopback with
+`-p 127.0.0.1:8000:8000`. Warm-cache key-free startup varies by image version
+and should not be assumed.
 
 ## Auth And Environment
 
-Do not print API keys. Confirm they exist with shell tests, not echoes.
+Use credentials already supplied in the environment or injected by a secret
+manager. Do not load credential files, print keys, or enable shell tracing.
+Confirm keys exist with shell tests.
 
 Hosted needs `NGC_API_KEY` in the request header. Local startup needs
 `NGC_API_KEY`, or `NVIDIA_API_KEY` as a fallback, plus `LOCAL_NIM_CACHE`.
-A repo-root `.env` file may be sourced as a local override before validation.
 
 ## Local Docker
 
 Use the official OpenFold3 NIM image and mount `LOCAL_NIM_CACHE` at
-`/opt/nim/.cache`. First startup downloads model artifacts and can take several
-minutes.
+`/opt/nim/.cache`. Before executing setup, explain that registry authentication
+sends the key to the NVIDIA registry at https://nvcr.io and first startup
+downloads about 10–15 GB of model weights into the cache. Run deployment only
+when requested; for a setup guide, provide the commands without running them.
 
 When writing local setup commands, copy the preflight below exactly. Do not
 replace it with a simple `: "${NGC_API_KEY:?Set NGC_API_KEY}"` check, do not
@@ -59,28 +63,27 @@ should show the literal `--gpus "device=0"`; choose a different device only
 when the user asks.
 
 ```bash
-set -a
-[ -f .env ] && . ./.env
-set +a
+set +x
 
 if [ -z "${NGC_API_KEY:-}" ] && [ -n "${NVIDIA_API_KEY:-}" ]; then
-  export NGC_API_KEY="$NVIDIA_API_KEY"
+  NGC_API_KEY="$NVIDIA_API_KEY"
 fi
 : "${NGC_API_KEY:?Set NGC_API_KEY or NVIDIA_API_KEY}"
+export NGC_API_KEY
 : "${LOCAL_NIM_CACHE:?Set LOCAL_NIM_CACHE}"
 
-echo "$NGC_API_KEY" | docker login nvcr.io --username '$oauthtoken' --password-stdin
-
 mkdir -p "${LOCAL_NIM_CACHE}"
 chmod 755 "${LOCAL_NIM_CACHE}"
 
+printf '%s\n' "$NGC_API_KEY" | \
+  docker login nvcr.io --username '$oauthtoken' --password-stdin && \
 docker run --rm --name openfold3 \
   --runtime=nvidia \
   --gpus "device=0" \
   --shm-size=16g \
   -e NGC_API_KEY \
   -v "${LOCAL_NIM_CACHE}:/opt/nim/.cache" \
-  -p 8000:8000 \
+  -p 127.0.0.1:8000:8000 \
   nvcr.io/nim/openfold/openfold3:latest
 ```
 
diff --git a/nim-skills/openfold3-nim/config/skillspector-baseline.yml b/nim-skills/openfold3-nim/config/skillspector-baseline.yml
index 761751d..db5e7b3 100644
--- a/nim-skills/openfold3-nim/config/skillspector-baseline.yml
+++ b/nim-skills/openfold3-nim/config/skillspector-baseline.yml
@@ -1,28 +1,6 @@
-# SkillSpector suppression baseline — openfold3-nim
-#
-# Audited false-positive suppression, auto-applied by the NVSkills Tier 1
-# runner via config/skillspector-baseline.yml. Suppressed findings remain in
-# the report JSON marked `suppressed: true` with the reason below.
-version: 1
-
-rules:
-  - id: "PE3"
-    path: "*SKILL.md"
-    reason: >-
-      Reviewed false positive (BioNeMo, omosafi@nvidia.com, 2026-08-12).
-      PE3 fires on the literal `.env` token in this NIM skill's documented
-      NGC_API_KEY loading snippet (`[ -f .env ] && . ./.env`), which reads the
-      user's own repo-root dotenv to obtain their NGC API key for
-      `docker login nvcr.io`. This is first-party, user-facing setup guidance for
-      the user's own credential file — not credential theft. No SSH keys, cloud
-      credential stores, or third-party secret files are accessed.
-  - id: "PE3"
-    path: "*references/api.md"
-    reason: >-
-      Reviewed false positive (BioNeMo, omosafi@nvidia.com, 2026-08-12).
-      PE3 fires on the literal `.env` token in this NIM skill's documented
-      NGC_API_KEY loading snippet (`[ -f .env ] && . ./.env`), which reads the
-      user's own repo-root dotenv to obtain their NGC API key for
-      `docker login nvcr.io`. This is first-party, user-facing setup guidance for
-      the user's own credential file — not credential theft. No SSH keys, cloud
-      credential stores, or third-party secret files are accessed.
+# No findings are suppressed. Keep an explicit per-skill baseline so NVSkills
+# does not fall back to the repository-wide baseline for unrelated skills.
+# Credential-file loading was removed from the instructions and evaluations.
+version: 2
+rules: []
+fingerprints: []
diff --git a/nim-skills/openfold3-nim/evals/evals.json b/nim-skills/openfold3-nim/evals/evals.json
index 044735c..f0c5e62 100644
--- a/nim-skills/openfold3-nim/evals/evals.json
+++ b/nim-skills/openfold3-nim/evals/evals.json
@@ -32,14 +32,16 @@
     {
       "id": "3",
       "prompt": "Help me set up the OpenFold3 NIM locally with Docker. I have an A100 80GB GPU and NGC_API_KEY is set. After setup, predict the structure of this protein: ACDEFGHIKLMNPQRSTVWY.",
-      "expected_output": "Docker setup commands using shell env first and optional repo-root .env overrides, requiring NGC_API_KEY or NVIDIA_API_KEY fallback plus LOCAL_NIM_CACHE, running with --gpus 'device=0', --shm-size=16g, and the correct cache mount path, then a health check loop and no-auth prediction script targeting localhost:8000.",
+      "expected_output": "Docker setup commands using supplied environment variables without loading credential files, requiring NGC_API_KEY or NVIDIA_API_KEY fallback plus LOCAL_NIM_CACHE, authenticating to nvcr.io using --password-stdin, and starting the container only after successful login. The container uses --gpus 'device=0', --shm-size=16g, the correct cache mount path, and port 8000 bound to 127.0.0.1, followed by a health check loop and no-auth prediction script targeting localhost:8000.",
       "files": [],
       "assertions": [
-        "[docker-login-nvcr] Includes docker login command for nvcr.io with oauthtoken: Output contains 'docker login nvcr.io' and 'oauthtoken'",
+        "[docker-login-nvcr] Authenticates image pulls before container startup: Commands use docker login nvcr.io with the literal username '$oauthtoken' and --password-stdin, passing NGC_API_KEY via stdin without exposing its value in logs or command-line arguments",
+        "[login-failure-stops-startup] Prevents startup after failed registry authentication: Commands use an explicit success condition or shell error handling so a failed login prevents container startup",
+        "[loopback-port-binding] Keeps the unauthenticated local API on loopback: The startup command publishes port 8000 with '-p 127.0.0.1:8000:8000' or equivalent --publish syntax",
         "[docker-image-tag] References the correct OpenFold3 container image: Output contains 'nvcr.io/nim/openfold/openfold3'",
         "[single-gpu-flag] Uses single GPU device specification: Output contains '--gpus' and 'device=0'",
         "[shm-size-flag] Includes --shm-size flag (required for this NIM): Output contains '--shm-size' and '16'",
-        "[env-contract-and-cache] Local setup uses the repo env contract and LOCAL_NIM_CACHE: Output sources repo-root .env only if present, supports NVIDIA_API_KEY fallback to NGC_API_KEY, requires LOCAL_NIM_CACHE, and mounts LOCAL_NIM_CACHE to /opt/nim/.cache",
+        "[env-contract-and-cache] Local setup uses supplied environment variables and LOCAL_NIM_CACHE: Commands use credentials from the environment without loading credential files, support NVIDIA_API_KEY fallback to NGC_API_KEY, export NGC_API_KEY for the container, require LOCAL_NIM_CACHE, and mount LOCAL_NIM_CACHE to /opt/nim/.cache",
         "[local-endpoint-url] Prediction script targets localhost:8000 without /v1/ prefix: Script contains 'localhost:8000/biology/openfold/openfold3/predict'"
       ]
     },
diff --git a/nim-skills/openfold3-nim/references/api.md b/nim-skills/openfold3-nim/references/api.md
index 82fe2d5..cd050c7 100644
--- a/nim-skills/openfold3-nim/references/api.md
+++ b/nim-skills/openfold3-nim/references/api.md
@@ -116,28 +116,35 @@
 
 ## Docker Reference
 
+Provide credentials and the cache path through the environment; this example
+does not load credential files. Keep shell tracing disabled. Registry login
+uses the key on stdin, and the container starts only if login succeeds.
+The container uses the key for entitlement checks and first-run model downloads
+of about 10–15 GB. Local inference is unauthenticated, so the published host
+port binds to loopback.
+
 ```bash
-set -a
-[ -f .env ] && . ./.env
-set +a
+set +x
 
-# Keep this fallback even when NGC_API_KEY is already set; it is the repo env contract.
 if [ -z "${NGC_API_KEY:-}" ] && [ -n "${NVIDIA_API_KEY:-}" ]; then
-  export NGC_API_KEY="$NVIDIA_API_KEY"
+  NGC_API_KEY="$NVIDIA_API_KEY"
 fi
-: "${NGC_API_KEY:?Set NGC_API_KEY or NVIDIA_API_KEY in the environment or repo-root .env}"
+: "${NGC_API_KEY:?Set NGC_API_KEY or NVIDIA_API_KEY}"
+export NGC_API_KEY
+: "${LOCAL_NIM_CACHE:?Set LOCAL_NIM_CACHE}"
 
-: "${LOCAL_NIM_CACHE:?Set LOCAL_NIM_CACHE in the environment or repo-root .env}"
 mkdir -p "${LOCAL_NIM_CACHE}"
 chmod 755 "${LOCAL_NIM_CACHE}"
 
+printf '%s\n' "$NGC_API_KEY" | \
+  docker login nvcr.io --username '$oauthtoken' --password-stdin && \
 docker run --rm --name openfold3 \
   --runtime=nvidia \
   --gpus "device=0" \
   --shm-size=16g \
   -e NGC_API_KEY \
   -v "${LOCAL_NIM_CACHE}:/opt/nim/.cache" \
-  -p 8000:8000 \
+  -p 127.0.0.1:8000:8000 \
   nvcr.io/nim/openfold/openfold3:latest
 ```
 
@@ -145,6 +152,7 @@ docker run --rm --name openfold3 \
 |---|---|---|
 | `--gpus` | `device=0` | Single GPU only; choose another device only when required |
 | `--shm-size` | `16g` | Required |
+| `-p` | `127.0.0.1:8000:8000` | Bind the unauthenticated API to the host's loopback address |
 | Cache mount | `/opt/nim/.cache` | ~10–15 GB model weights |
 | Image | `nvcr.io/nim/openfold/openfold3:latest` | v1.4.0 as of 2025 |
 
diff --git a/skills/bionemo-agent-toolkit/skills/openfold3-nim/SKILL.md b/skills/bionemo-agent-toolkit/skills/openfold3-nim/SKILL.md
index 87bd8c6..c627c99 100644
--- a/skills/bionemo-agent-toolkit/skills/openfold3-nim/SKILL.md
+++ b/skills/bionemo-agent-toolkit/skills/openfold3-nim/SKILL.md
@@ -11,14 +11,14 @@ allowed-tools: Bash, Read, Write, AskUserQuestion
 
 Predict biomolecular structures with OpenFold3. It supports proteins, DNA, RNA,
 small-molecule ligands, and multi-entity assemblies. Use this guide for
-basic hosted/local NIM use; load supplemental files only when the task needs
+basic hosted and local NIM use; load supplemental files only when the task needs
 deeper context:
 
 - `references/api.md`: exact endpoints, schemas, Docker flags, response fields.
 - `references/science.md`: purpose, strengths, limitations, and model handoffs.
 - `references/parameters.md`: molecule fields, MSAs, templates, samples, tuning.
 - `references/validation.md`: artifact checks and scientific sanity checks.
-- `references/examples.md`: compact hosted/local request patterns.
+- `references/examples.md`: compact hosted and local request patterns.
 
 ## Choose Mode
 
@@ -34,22 +34,26 @@ Mode difference: the local prediction path has no `/v1/` prefix. Hosted requests
 startup uses `NGC_API_KEY` (or `NVIDIA_API_KEY` via the preflight) for
 registry login, entitlement checks, and first-run model downloads; pass it
 into the container with `-e NGC_API_KEY`. Local inference requests use no
-auth header after readiness. Warm-cache key-free startup varies by
-image/version and should not be assumed.
+auth header after readiness, so bind the host port to loopback with
+`-p 127.0.0.1:8000:8000`. Warm-cache key-free startup varies by image version
+and should not be assumed.
 
 ## Auth And Environment
 
-Do not print API keys. Confirm they exist with shell tests, not echoes.
+Use credentials already supplied in the environment or injected by a secret
+manager. Do not load credential files, print keys, or enable shell tracing.
+Confirm keys exist with shell tests.
 
 Hosted needs `NGC_API_KEY` in the request header. Local startup needs
 `NGC_API_KEY`, or `NVIDIA_API_KEY` as a fallback, plus `LOCAL_NIM_CACHE`.
-A repo-root `.env` file may be sourced as a local override before validation.
 
 ## Local Docker
 
 Use the official OpenFold3 NIM image and mount `LOCAL_NIM_CACHE` at
-`/opt/nim/.cache`. First startup downloads model artifacts and can take several
-minutes.
+`/opt/nim/.cache`. Before executing setup, explain that registry authentication
+sends the key to the NVIDIA registry at https://nvcr.io and first startup
+downloads about 10–15 GB of model weights into the cache. Run deployment only
+when requested; for a setup guide, provide the commands without running them.
 
 When writing local setup commands, copy the preflight below exactly. Do not
 replace it with a simple `: "${NGC_API_KEY:?Set NGC_API_KEY}"` check, do not
@@ -59,28 +63,27 @@ should show the literal `--gpus "device=0"`; choose a different device only
 when the user asks.
 
 ```bash
-set -a
-[ -f .env ] && . ./.env
-set +a
+set +x
 
 if [ -z "${NGC_API_KEY:-}" ] && [ -n "${NVIDIA_API_KEY:-}" ]; then
-  export NGC_API_KEY="$NVIDIA_API_KEY"
+  NGC_API_KEY="$NVIDIA_API_KEY"
 fi
 : "${NGC_API_KEY:?Set NGC_API_KEY or NVIDIA_API_KEY}"
+export NGC_API_KEY
 : "${LOCAL_NIM_CACHE:?Set LOCAL_NIM_CACHE}"
 
-echo "$NGC_API_KEY" | docker login nvcr.io --username '$oauthtoken' --password-stdin
-
 mkdir -p "${LOCAL_NIM_CACHE}"
 chmod 755 "${LOCAL_NIM_CACHE}"
 
+printf '%s\n' "$NGC_API_KEY" | \
+  docker login nvcr.io --username '$oauthtoken' --password-stdin && \
 docker run --rm --name openfold3 \
   --runtime=nvidia \
   --gpus "device=0" \
   --shm-size=16g \
   -e NGC_API_KEY \
   -v "${LOCAL_NIM_CACHE}:/opt/nim/.cache" \
-  -p 8000:8000 \
+  -p 127.0.0.1:8000:8000 \
   nvcr.io/nim/openfold/openfold3:latest
 ```
 
diff --git a/skills/bionemo-agent-toolkit/skills/openfold3-nim/config/skillspector-baseline.yml b/skills/bionemo-agent-toolkit/skills/openfold3-nim/config/skillspector-baseline.yml
index 761751d..db5e7b3 100644
--- a/skills/bionemo-agent-toolkit/skills/openfold3-nim/config/skillspector-baseline.yml
+++ b/skills/bionemo-agent-toolkit/skills/openfold3-nim/config/skillspector-baseline.yml
@@ -1,28 +1,6 @@
-# SkillSpector suppression baseline — openfold3-nim
-#
-# Audited false-positive suppression, auto-applied by the NVSkills Tier 1
-# runner via config/skillspector-baseline.yml. Suppressed findings remain in
-# the report JSON marked `suppressed: true` with the reason below.
-version: 1
-
-rules:
-  - id: "PE3"
-    path: "*SKILL.md"
-    reason: >-
-      Reviewed false positive (BioNeMo, omosafi@nvidia.com, 2026-08-12).
-      PE3 fires on the literal `.env` token in this NIM skill's documented
-      NGC_API_KEY loading snippet (`[ -f .env ] && . ./.env`), which reads the
-      user's own repo-root dotenv to obtain their NGC API key for
-      `docker login nvcr.io`. This is first-party, user-facing setup guidance for
-      the user's own credential file — not credential theft. No SSH keys, cloud
-      credential stores, or third-party secret files are accessed.
-  - id: "PE3"
-    path: "*references/api.md"
-    reason: >-
-      Reviewed false positive (BioNeMo, omosafi@nvidia.com, 2026-08-12).
-      PE3 fires on the literal `.env` token in this NIM skill's documented
-      NGC_API_KEY loading snippet (`[ -f .env ] && . ./.env`), which reads the
-      user's own repo-root dotenv to obtain their NGC API key for
-      `docker login nvcr.io`. This is first-party, user-facing setup guidance for
-      the user's own credential file — not credential theft. No SSH keys, cloud
-      credential stores, or third-party secret files are accessed.
+# No findings are suppressed. Keep an explicit per-skill baseline so NVSkills
+# does not fall back to the repository-wide baseline for unrelated skills.
+# Credential-file loading was removed from the instructions and evaluations.
+version: 2
+rules: []
+fingerprints: []
diff --git a/skills/bionemo-agent-toolkit/skills/openfold3-nim/evals/evals.json b/skills/bionemo-agent-toolkit/skills/openfold3-nim/evals/evals.json
index 044735c..f0c5e62 100644
--- a/skills/bionemo-agent-toolkit/skills/openfold3-nim/evals/evals.json
+++ b/skills/bionemo-agent-toolkit/skills/openfold3-nim/evals/evals.json
@@ -32,14 +32,16 @@
     {
       "id": "3",
       "prompt": "Help me set up the OpenFold3 NIM locally with Docker. I have an A100 80GB GPU and NGC_API_KEY is set. After setup, predict the structure of this protein: ACDEFGHIKLMNPQRSTVWY.",
-      "expected_output": "Docker setup commands using shell env first and optional repo-root .env overrides, requiring NGC_API_KEY or NVIDIA_API_KEY fallback plus LOCAL_NIM_CACHE, running with --gpus 'device=0', --shm-size=16g, and the correct cache mount path, then a health check loop and no-auth prediction script targeting localhost:8000.",
+      "expected_output": "Docker setup commands using supplied environment variables without loading credential files, requiring NGC_API_KEY or NVIDIA_API_KEY fallback plus LOCAL_NIM_CACHE, authenticating to nvcr.io using --password-stdin, and starting the container only after successful login. The container uses --gpus 'device=0', --shm-size=16g, the correct cache mount path, and port 8000 bound to 127.0.0.1, followed by a health check loop and no-auth prediction script targeting localhost:8000.",
       "files": [],
       "assertions": [
-        "[docker-login-nvcr] Includes docker login command for nvcr.io with oauthtoken: Output contains 'docker login nvcr.io' and 'oauthtoken'",
+        "[docker-login-nvcr] Authenticates image pulls before container startup: Commands use docker login nvcr.io with the literal username '$oauthtoken' and --password-stdin, passing NGC_API_KEY via stdin without exposing its value in logs or command-line arguments",
+        "[login-failure-stops-startup] Prevents startup after failed registry authentication: Commands use an explicit success condition or shell error handling so a failed login prevents container startup",
+        "[loopback-port-binding] Keeps the unauthenticated local API on loopback: The startup command publishes port 8000 with '-p 127.0.0.1:8000:8000' or equivalent --publish syntax",
         "[docker-image-tag] References the correct OpenFold3 container image: Output contains 'nvcr.io/nim/openfold/openfold3'",
         "[single-gpu-flag] Uses single GPU device specification: Output contains '--gpus' and 'device=0'",
         "[shm-size-flag] Includes --shm-size flag (required for this NIM): Output contains '--shm-size' and '16'",
-        "[env-contract-and-cache] Local setup uses the repo env contract and LOCAL_NIM_CACHE: Output sources repo-root .env only if present, supports NVIDIA_API_KEY fallback to NGC_API_KEY, requires LOCAL_NIM_CACHE, and mounts LOCAL_NIM_CACHE to /opt/nim/.cache",
+        "[env-contract-and-cache] Local setup uses supplied environment variables and LOCAL_NIM_CACHE: Commands use credentials from the environment without loading credential files, support NVIDIA_API_KEY fallback to NGC_API_KEY, export NGC_API_KEY for the container, require LOCAL_NIM_CACHE, and mount LOCAL_NIM_CACHE to /opt/nim/.cache",
         "[local-endpoint-url] Prediction script targets localhost:8000 without /v1/ prefix: Script contains 'localhost:8000/biology/openfold/openfold3/predict'"
       ]
     },
diff --git a/skills/bionemo-agent-toolkit/skills/openfold3-nim/references/api.md b/skills/bionemo-agent-toolkit/skills/openfold3-nim/references/api.md
index 82fe2d5..cd050c7 100644
--- a/skills/bionemo-agent-toolkit/skills/openfold3-nim/references/api.md
+++ b/skills/bionemo-agent-toolkit/skills/openfold3-nim/references/api.md
@@ -116,28 +116,35 @@
 
 ## Docker Reference
 
+Provide credentials and the cache path through the environment; this example
+does not load credential files. Keep shell tracing disabled. Registry login
+uses the key on stdin, and the container starts only if login succeeds.
+The container uses the key for entitlement checks and first-run model downloads
+of about 10–15 GB. Local inference is unauthenticated, so the published host
+port binds to loopback.
+
 ```bash
-set -a
-[ -f .env ] && . ./.env
-set +a
+set +x
 
-# Keep this fallback even when NGC_API_KEY is already set; it is the repo env contract.
 if [ -z "${NGC_API_KEY:-}" ] && [ -n "${NVIDIA_API_KEY:-}" ]; then
-  export NGC_API_KEY="$NVIDIA_API_KEY"
+  NGC_API_KEY="$NVIDIA_API_KEY"
 fi
-: "${NGC_API_KEY:?Set NGC_API_KEY or NVIDIA_API_KEY in the environment or repo-root .env}"
+: "${NGC_API_KEY:?Set NGC_API_KEY or NVIDIA_API_KEY}"
+export NGC_API_KEY
+: "${LOCAL_NIM_CACHE:?Set LOCAL_NIM_CACHE}"
 
-: "${LOCAL_NIM_CACHE:?Set LOCAL_NIM_CACHE in the environment or repo-root .env}"
 mkdir -p "${LOCAL_NIM_CACHE}"
 chmod 755 "${LOCAL_NIM_CACHE}"
 
+printf '%s\n' "$NGC_API_KEY" | \
+  docker login nvcr.io --username '$oauthtoken' --password-stdin && \
 docker run --rm --name openfold3 \
   --runtime=nvidia \
   --gpus "device=0" \
   --shm-size=16g \
   -e NGC_API_KEY \
   -v "${LOCAL_NIM_CACHE}:/opt/nim/.cache" \
-  -p 8000:8000 \
+  -p 127.0.0.1:8000:8000 \
   nvcr.io/nim/openfold/openfold3:latest
 ```
 
@@ -145,6 +152,7 @@ docker run --rm --name openfold3 \
 |---|---|---|
 | `--gpus` | `device=0` | Single GPU only; choose another device only when required |
 | `--shm-size` | `16g` | Required |
+| `-p` | `127.0.0.1:8000:8000` | Bind the unauthenticated API to the host's loopback address |
 | Cache mount | `/opt/nim/.cache` | ~10–15 GB model weights |
 | Image | `nvcr.io/nim/openfold/openfold3:latest` | v1.4.0 as of 2025 |
 

From a6058f9f835a049d15d15f2bf8cf7e2d37b733b5 Mon Sep 17 00:00:00 2001
From: nvskills-svc-account <svc-nvskills-signing@nvidia.com>
Date: Wed, 30 Sep 2026 21:01:34 +0000
Subject: [PATCH 3/3] Attach NVSkills validation signatures

Signed-off-by: nvskills-svc-account <svc-nvskills-signing@nvidia.com>
---
 .../skills/openfold3-nim/BENCHMARK.md         | 127 ++++++++++++++++++
 .../skills/openfold3-nim/skill-card.md        |  86 ++++++++++++
 .../skills/openfold3-nim/skill.oms.sig        |   1 +
 3 files changed, 214 insertions(+)
 create mode 100644 skills/bionemo-agent-toolkit/skills/openfold3-nim/BENCHMARK.md
 create mode 100644 skills/bionemo-agent-toolkit/skills/openfold3-nim/skill-card.md
 create mode 100644 skills/bionemo-agent-toolkit/skills/openfold3-nim/skill.oms.sig

diff --git a/skills/bionemo-agent-toolkit/skills/openfold3-nim/BENCHMARK.md b/skills/bionemo-agent-toolkit/skills/openfold3-nim/BENCHMARK.md
new file mode 100644
index 0000000..358c26d
--- /dev/null
+++ b/skills/bionemo-agent-toolkit/skills/openfold3-nim/BENCHMARK.md
@@ -0,0 +1,127 @@
+# Skill Benchmark: openfold3-nim
+
+> ✅ **Overall verdict: PASS — Recommended for publication**
+
+## Publication Recommendation
+
+Recommended for publication based on the completed evaluation evidence in this report.
+
+## Evaluation Metadata
+
+- Skill: `openfold3-nim`
+- Evaluation date: 2026-09-30
+- Evaluator version: `1.5.6`
+- Agents: Claude Code (`aws/anthropic/bedrock-claude-opus-4-8`), Codex (`openai/openai/gpt-5.5`)
+- Tasks: 4 evaluation tasks (4 positive)
+- Dataset digest: `sha256:405d82d91432042dcd7576e872a7acae051a4a4fef41962393f6e84e901b1513` (skill-evaluator-dataset-snapshot/1)
+- Attempts per task: 3
+- Environment: `k8s-sandbox`
+- Tier 2 evidence: required for publication
+- Tier 3 evidence: required for publication
+
+Each task attempt ran in its own isolated sandbox pod.
+
+## What This Report Answers
+
+The three-tier evaluation checks whether the skill:
+
+- is safe to use;
+- produces correct answers;
+- is discovered and activated when needed;
+- helps the agent complete the user's goal and expected workflow; and
+- avoids wasted skill and tool usage.
+
+## Results at a Glance
+
+| Measure | Claude Code (Baseline → Skill Uplift) | Codex (Baseline → Skill Uplift) |
+|---|---:|---:|
+| Overall | 91.2% — baseline ran, but no comparable score was available; uplift unavailable | 83.6% — baseline ran, but no comparable score was available; uplift unavailable |
+| Security | 50.0% → 87.5% (+37.5 points) | 30.0% → 75.0% (+45.0 points) |
+| Correctness | 85.0% → 100.0% (+15.0 points) | 92.0% → 95.0% (+3.0 points) |
+| Discoverability | 100.0% — baseline ran, but no comparable score was available; uplift unavailable | 91.3% — baseline ran, but no comparable score was available; uplift unavailable |
+| Effectiveness | 71.0% → 88.4% (+17.4 points) | 61.2% → 77.0% (+15.8 points) |
+| Efficiency | 79.8% — baseline ran, but no comparable score was available; uplift unavailable | 79.9% — baseline ran, but no comparable score was available; uplift unavailable |
+
+**How to read this table:** baseline is the same task attempted without the target skill. Scores are rounded to one decimal; threshold-adjacent values use additional precision so their displayed band matches the verdict. Uplift is derived from those displayed scores and shown in percentage points.
+
+Example: `47.0% → 92.0% (+45.0 points)` means the skill-assisted run scored 92.0%, 45.0 percentage points above its 47.0% no-skill baseline.
+
+## Token Usage
+
+Actual Tier 3 execution usage is reported for every observed agent/case pair and both conditions.
+
+| Agent | Dataset case | With skill | Without skill | Delta | Change | Coverage |
+|---|---|---:|---:|---:|---:|---|
+| claude-code | All cases | 677,568 | 3,030,703 | -2,353,135 | -77.64% | skill 4/4; base 4/4 |
+| claude-code | 1 | 199,955 | 580,721 | -380,766 | -65.57% | skill 1/1; base 1/1 |
+| claude-code | 2 | 164,711 | 2,055,944 | -1,891,233 | -91.99% | skill 1/1; base 1/1 |
+| claude-code | 3 | 173,566 | 186,230 | -12,664 | -6.80% | skill 1/1; base 1/1 |
+| claude-code | 4 | 139,336 | 207,808 | -68,472 | -32.95% | skill 1/1; base 1/1 |
+| codex | All cases | 457,858 | 1,176,860 | N/A | N/A | skill 4/4; base 5/5 |
+| codex | 1 | 99,872 | 222,120 | -122,248 | -55.04% | skill 1/1; base 1/1 |
+| codex | 2 | 99,645 | 254,679 | -155,034 | -60.87% | skill 1/1; base 1/1 |
+| codex | 3 | 190,961 | 675,195 | N/A | N/A | skill 1/1; base 2/2 |
+| codex | 4 | 67,380 | 24,866 | +42,514 | +170.97% | skill 1/1; base 1/1 |
+| ALL AGENTS | Dataset aggregate | 1,135,426 | 4,207,563 | N/A | N/A | skill 8/8; base 9/9 |
+
+Prompt tokens include cached reads, so total tokens are `prompt + completion` (cached is not added twice). The Efficiency score uses `(prompt - cached) + completion`. N/A means the relevant trajectory counters were not available; coverage is never estimated.
+
+## Tier Status
+
+| Tier | Purpose | Status | Evidence |
+|---|---|---|---|
+| Tier 1 | Static validation | **PASSED WITH OBSERVATIONS** | 11 validator(s); 25 finding(s) |
+| Tier 2 | Semantic deduplication | **PASSED WITH OBSERVATIONS** | 2 validator(s); 1 finding(s) |
+| Tier 3 | Live agent evaluation | **PASS** | 2 agent(s); 4 task(s) |
+
+## Findings and Observations
+
+<details>
+<summary>Show detailed findings and successful checks</summary>
+
+- **HIGH** DUPLICATE/duplicate: Duplicate content found across SKILL.md and references/api.md:
+  "## Local Docker" in SKILL.md (lines 41-86)
+  vs "## Docker Reference" in references/api.md (lines 117-160) (`SKILL.md:41`)
+- **MEDIUM** QUALITY/quality_correctness: SKILL_SPEC recommended field missing: 'metadata.author' (`skills/bionemo-agent-toolkit/skills/openfold3-nim/SKILL.md`)
+- **MEDIUM** QUALITY/quality_correctness: SKILL_SPEC recommended field missing: 'metadata.tags' (`skills/bionemo-agent-toolkit/skills/openfold3-nim/SKILL.md`)
+- **MEDIUM** QUALITY/quality_efficiency: Deeply nested references in parameters.md (`skills/bionemo-agent-toolkit/skills/openfold3-nim/SKILL.md`)
+- **MEDIUM** SCHEMA/folder_hierarchy: Unexpected nesting depth for general skill (`skills/bionemo-agent-toolkit/skills/openfold3-nim`)
+- 21 additional finding(s) are available in the full evaluation artifacts.
+
+</details>
+
+## Scoring Methodology
+
+<details>
+<summary>Show dimension definitions, source signals, and thresholds</summary>
+
+| Dimension | Question | Scored signals |
+|---|---|---|
+| Security | Is it safe to use? | `security` (100%) |
+| Correctness | Is the answer correct? | `accuracy` (100%) |
+| Discoverability | Was the right skill loaded when needed? | `skill_execution` (100%) |
+| Effectiveness | Did the skill help complete the task? | `goal_accuracy` (50%) + `behavior_check` (50%) |
+| Efficiency | Did it avoid wasted tool calls and token usage? | `skill_efficiency` (50%) + `token_efficiency` (50%) |
+
+- Dimension bands: PASS at 50% or above; NEUTRAL from 40% to below 50%; FAIL below 40%.
+- Overall Tier 3 lift: PASS at +5 points or more; FAIL at -10 points or less; values between those bands are NEUTRAL.
+- Overall verdict: PASS only when every configured dimension passes for at least one supported agent. Lift is reported as diagnostic evidence and does not override this gate.
+- The 50% attempt pass threshold is a separate per-task gate; it is not the dimension pass threshold.
+- Effectiveness is the equal-weight mean of goal completion (`goal_accuracy`) and expected workflow adherence (`behavior_check`).
+- Efficiency is 50% tool-call productivity (the backward-compatible `skill_efficiency` wire id) and 50% `token_efficiency`. Positive-case skill routing is scored under Discoverability, not Efficiency; a negative case without a routing target is N/A. N/A sources are omitted, remaining weights are renormalized, and the dimension is marked partial.
+
+Signals present in this run:
+
+- `security` (Security): unsafe operations, secret leakage, and unauthorized access.
+- `skill_execution` (Skill Execution): whether the expected skill was selected, decoys were avoided, and the workflow executed.
+- `skill_efficiency` (Tool Productivity): tool-call productivity (legacy wire id; routing is scored under Discoverability).
+- `accuracy` (Accuracy): final-answer correctness against the reference answer.
+- `goal_accuracy` (Goal Accuracy): whether the user's goal was achieved.
+- `behavior_check` (Behavior Check): whether the expected workflow behavior was followed.
+- `token_efficiency` (Token Efficiency): actual uncached prompt plus completion usage (50% of Efficiency).
+
+</details>
+
+## Freshness
+
+Regenerate this benchmark when the skill, evaluation dataset, target agent/model, evaluator version, environment, or scoring policy changes.
diff --git a/skills/bionemo-agent-toolkit/skills/openfold3-nim/skill-card.md b/skills/bionemo-agent-toolkit/skills/openfold3-nim/skill-card.md
new file mode 100644
index 0000000..8624167
--- /dev/null
+++ b/skills/bionemo-agent-toolkit/skills/openfold3-nim/skill-card.md
@@ -0,0 +1,86 @@
+## Description: <br>
+Use this skill for OpenFold3, NVIDIA's BioNeMo NIM microservice for biomolecular structure prediction. <br>
+
+This skill is ready for commercial/non-commercial use. <br>
+
+## Owner
+NVIDIA <br>
+
+### License/Terms of Use: <br>
+Apache-2.0 AND CC-BY-4.0 <br>
+## Use Case: <br>
+Developers and computational biologists who need to predict biomolecular structures — proteins, protein-ligand complexes, protein-DNA/RNA assemblies — using NVIDIA's hosted OpenFold3 API or a local Docker NIM deployment. <br>
+
+### Deployment Geography for Use: <br>
+Global <br>
+
+## Requirements / Dependencies: <br>
+**Requires API Key or External Credential:** [Yes] <br>
+**Credential Type(s):** [API key] <br>
+
+Do not include secrets in prompts/logs/output; use least-privilege credentials; rotate keys as appropriate. <br>
+
+## Known Risks and Mitigations: <br>
+Risk: Review before execution as proposals could introduce incorrect or misleading guidance into skills. <br>
+Mitigation: Review and scan skill before deployment. <br>
+
+## Reference(s): <br>
+- [API Reference](references/api.md) <br>
+- [Examples](references/examples.md) <br>
+- [Parameter Reference](references/parameters.md) <br>
+- [Science Guide](references/science.md) <br>
+- [Validation Guide](references/validation.md) <br>
+
+
+## Skill Output: <br>
+**Output Type(s):** [API Calls, Files, Analysis] <br>
+**Output Format:** [Markdown with inline Python code blocks] <br>
+**Output Parameters:** [1D] <br>
+**Other Properties Related to Output:** [None] <br>
+
+## Evaluation Agents Used: <br>
+- Claude Code (`aws/anthropic/bedrock-claude-opus-4-8`) <br>
+- Codex (`openai/openai/gpt-5.5`) <br>
+
+
+
+## Evaluation Tasks: <br>
+4 evaluation tasks (4 positive), 3 attempts per task, each in an isolated k8s-sandbox pod. <br>
+
+## Evaluation Metrics Used: <br>
+Reported benchmark dimensions: <br>
+- Security: Checks for unsafe operations, secret leakage, and unauthorized access. <br>
+- Correctness: Checks final-answer correctness against the reference answer. <br>
+- Discoverability: Checks whether the expected skill was selected, decoys avoided, and workflow executed. <br>
+- Effectiveness: Checks whether the user's goal was achieved and expected workflow behavior was followed. <br>
+- Efficiency: Checks tool-call productivity and token efficiency. <br>
+
+Underlying evaluation signals used in this run: <br>
+- `security`: Detects unsafe operations, secret leakage, and unauthorized access. <br>
+- `skill_execution`: Whether the expected skill was selected, decoys avoided, and the workflow executed. <br>
+- `skill_efficiency`: Tool-call productivity; routing is scored under Discoverability. <br>
+- `accuracy`: Final-answer correctness against the reference answer. <br>
+- `goal_accuracy`: Whether the user's goal was achieved. <br>
+- `behavior_check`: Whether the expected workflow behavior was followed. <br>
+- `token_efficiency`: Actual uncached prompt plus completion usage. <br>
+
+
+
+## Evaluation Results: <br>
+| Measure | Claude Code (Baseline → Skill Uplift) | Codex (Baseline → Skill Uplift) |
+|---|---:|---:|
+| Overall | 91.2% | 83.6% |
+| Security | 50.0% → 87.5% (+37.5 points) | 30.0% → 75.0% (+45.0 points) |
+| Correctness | 85.0% → 100.0% (+15.0 points) | 92.0% → 95.0% (+3.0 points) |
+| Discoverability | 100.0% | 91.3% |
+| Effectiveness | 71.0% → 88.4% (+17.4 points) | 61.2% → 77.0% (+15.8 points) |
+| Efficiency | 79.8% | 79.9% |
+
+## Skill Version(s): <br>
+0.1.0 (source: pyproject.toml) <br>
+
+## Ethical Considerations: <br>
+NVIDIA believes Trustworthy AI is a shared responsibility and we have established policies and practices to enable development for a wide array of AI applications. When downloaded or used in accordance with our terms of service, developers should work with their internal team to ensure this skill meets requirements for the relevant industry and use case and addresses unforeseen product misuse. <br>
+
+(For Release on NVIDIA Platforms Only) <br>
+Please report quality, risk, security vulnerabilities or NVIDIA AI Concerns [here](https://app.intigriti.com/programs/nvidia/nvidiavdp/detail). <br>
diff --git a/skills/bionemo-agent-toolkit/skills/openfold3-nim/skill.oms.sig b/skills/bionemo-agent-toolkit/skills/openfold3-nim/skill.oms.sig
new file mode 100644
index 0000000..9dd4fa1
--- /dev/null
+++ b/skills/bionemo-agent-toolkit/skills/openfold3-nim/skill.oms.sig
@@ -0,0 +1 @@
+{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"x509CertificateChain":{"certificates":[{"rawBytes":"MIICgzCCAgmgAwIBAgIUKIyS7SxNteQIiWzK1dWj85E6520wCgYIKoZIzj0EAwMwVTELMAkGA1UEBhMCVVMxGzAZBgNVBAoMEk5WSURJQSBDb3Jwb3JhdGlvbjEpMCcGA1UEAwwgTlZJRElBIEFnZW50IENhcGFiaWxpdGllcyBJQ0EgMDEwHhcNMjYwNDAxMDAwMDAwWhcNMjgwNDIyMTUzMzA5WjBUMQswCQYDVQQGEwJVUzEbMBkGA1UECgwSTlZJRElBIENvcnBvcmF0aW9uMSgwJgYDVQQDDB9OVklESUEgQWdlbnQgU2tpbGxzIFNpZ25pbmcgMDAxMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYoRM9bQl/dGlwSRNi6bTpIJUXH8Nv9GciP6LSflJYYMLCc296kpyuTSsk5ddbAWiDcFX3C/ydX3jwc+qCLYP6uHy9XphyLjOQ27Yb2J6rBLVtRBS1mgGco/Gr7fL6ODco4GaMIGXMB0GA1UdDgQWBBRQ/5ZW3nJ6lmo9SVk7I15o7UGmpTAfBgNVHSMEGDAWgBRPGpILxMBBleJSsBGjrMKsby1CgjAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIHgDA3BggrBgEFBQcBAQQrMCkwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLm5kaXMubnZpZGlhLmNvbTAKBggqhkjOPQQDAwNoADBlAjAUygu/GiOCIXrgGr4SmLgeEVDcEitfFUv7ALbvLVGVyMysB3mxmO/uInZfXzWcJZsCMQDxuoxj4ZmO30jhkPIcCxGFCOvnUsnfU3TfGcouYm4M6iRpbKvtVnHPiy4bi6pcKf0="},{"rawBytes":"MIICiDCCAg6gAwIBAgIUZsIuSv9NkpJCNqtYEfCouVv5BzowCgYIKoZIzj0EAwMwUTELMAkGA1UEBhMCVVMxGzAZBgNVBAoMEk5WSURJQSBDb3Jwb3JhdGlvbjElMCMGA1UEAwwcTlZJRElBIEFnZW50IENhcGFiaWxpdGllcyBDQTAgFw0yNjA0MDEwMDAwMDBaGA85OTk5MTIzMTIzNTk1OVowVTELMAkGA1UEBhMCVVMxGzAZBgNVBAoMEk5WSURJQSBDb3Jwb3JhdGlvbjEpMCcGA1UEAwwgTlZJRElBIEFnZW50IENhcGFiaWxpdGllcyBJQ0EgMDEwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAASI72cR3ctKGg4VWnB3bNja6g1Z2PnOmFEopkPof+QeIcPk9rT+g9MjJnq51EQXL93a7C2GJ9J985G4o2V85VD7wJ1RaXhluHW2rf3y8bQGeAYaKMr5s/hUgn+M3/9WlWejgaAwgZ0wHQYDVR0OBBYEFE8akgvEwEGV4lKwEaOswqxvLUKCMB8GA1UdIwQYMBaAFItnoAjjfuCEUvzyvWyI2vOGvwPjMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEGMDcGCCsGAQUFBwEBBCswKTAnBggrBgEFBQcwAYYbaHR0cDovL29jc3AubmRpcy5udmlkaWEuY29tMAoGCCqGSM49BAMDA2gAMGUCMQCeIMMfAbyzPDacw2MxG+Yt1cikrJX/DVxiGfXuHmkkXn6VgSzE79+lkqDErpVO2gYCMCNEColOyvUvkzZGUEI1hQ3PfMgi3FIo9tHoBKMw4/wGBLFpu/0ubtmbBXM6/UMOEw=="},{"rawBytes":"MIICRTCCAcygAwIBAgIUeJdY3rV86EdvFmG7L8LJBsyQFYkwCgYIKoZIzj0EAwMwUTELMAkGA1UEBhMCVVMxGzAZBgNVBAoMEk5WSURJQSBDb3Jwb3JhdGlvbjElMCMGA1UEAwwcTlZJRElBIEFnZW50IENhcGFiaWxpdGllcyBDQTAgFw0yNjA0MDEwMDAwMDBaGA85OTk5MTIzMTIzNTk1OVowUTELMAkGA1UEBhMCVVMxGzAZBgNVBAoMEk5WSURJQSBDb3Jwb3JhdGlvbjElMCMGA1UEAwwcTlZJRElBIEFnZW50IENhcGFiaWxpdGllcyBDQTB2MBAGByqGSM49AgEGBSuBBAAiA2IABAYpiXCDjJ9NT2eSDhyHJVSw1Tbze18cGG2F/578oWvHxg23eQAhNRYdq88i1iOshZSO6C29doKui5Xpmo/7Ctw9Sx4PP2RzOmIuOLCuTdNtKcTRwi4GEsd5BAFvWj42M6NjMGEwHQYDVR0OBBYEFItnoAjjfuCEUvzyvWyI2vOGvwPjMB8GA1UdIwQYMBaAFItnoAjjfuCEUvzyvWyI2vOGvwPjMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2cAMGQCMCwtAjWLaNwgGWNCgdyNoTyvNhqWRECRJV2r3+7w8g0PL6NHLOsbkgE09BH95h8XlgIwTaQmbbUh2ChAJ5TA1wRiVDnCcvbzHlZl2jM2FcwQQZlk19LOAbyGMRixbu2Ww/rj"}]},"tlogEntries":[]},"dsseEnvelope":{"payload":"ewogICJfdHlwZSI6ICJodHRwczovL2luLXRvdG8uaW8vU3RhdGVtZW50L3YxIiwKICAic3ViamVjdCI6IFsKICAgIHsKICAgICAgIm5hbWUiOiAib3BlbmZvbGQzLW5pbSIsCiAgICAgICJkaWdlc3QiOiB7CiAgICAgICAgInNoYTI1NiI6ICIwMWY2YmMxOGJkMjlmZjBmYmQyZjk5MjcxMGVhOWQxNDlmODZkNWRhOWM0YmU3OWJmMDViZDZiMjQzMTMyNzgyIgogICAgICB9CiAgICB9CiAgXSwKICAicHJlZGljYXRlVHlwZSI6ICJodHRwczovL21vZGVsX3NpZ25pbmcvc2lnbmF0dXJlL3YxLjAiLAogICJwcmVkaWNhdGUiOiB7CiAgICAic2VyaWFsaXphdGlvbiI6IHsKICAgICAgIm1ldGhvZCI6ICJmaWxlcyIsCiAgICAgICJhbGxvd19zeW1saW5rcyI6IGZhbHNlLAogICAgICAiaWdub3JlX3BhdGhzIjogWwogICAgICAgICIuZ2l0aWdub3JlIiwKICAgICAgICAiLmdpdCIsCiAgICAgICAgIi5naXRodWIiLAogICAgICAgICIuZ2l0YXR0cmlidXRlcyIKICAgICAgXSwKICAgICAgImhhc2hfdHlwZSI6ICJzaGEyNTYiCiAgICB9LAogICAgInJlc291cmNlcyI6IFsKICAgICAgewogICAgICAgICJkaWdlc3QiOiAiNzQzMmM5OTcxYmRmMDMxMWQ0MGFiMDQ4ZDZkZGI1NWNhMzRiNmNjNDEzZDMzMzZlNTlkMzNhZDczOTQ3OWQ1OCIsCiAgICAgICAgIm5hbWUiOiAiQkVOQ0hNQVJLLm1kIiwKICAgICAgICAiYWxnb3JpdGhtIjogInNoYTI1NiIKICAgICAgfSwKICAgICAgewogICAgICAgICJkaWdlc3QiOiAiYTQwYTg0MGM4NTQyMzMxZWQzZTllMDhkOTM5MGJmOWI4OGU2ZjlkM2M0NjQyNmNjMmQwN2JlNjdhODk5YzJhNiIsCiAgICAgICAgIm5hbWUiOiAiU0tJTEwubWQiLAogICAgICAgICJhbGdvcml0aG0iOiAic2hhMjU2IgogICAgICB9LAogICAgICB7CiAgICAgICAgImRpZ2VzdCI6ICI0MDgyYzljZGY5ODVkZDU2Y2E0MWRmN2M1MTE3YTUwYmE1MTE5NDFjOGMzM2U5NGM2ODQyOTE4NGQ4ODU0Yjk5IiwKICAgICAgICAibmFtZSI6ICJjb25maWcvc2tpbGxzcGVjdG9yLWJhc2VsaW5lLnltbCIsCiAgICAgICAgImFsZ29yaXRobSI6ICJzaGEyNTYiCiAgICAgIH0sCiAgICAgIHsKICAgICAgICAiZGlnZXN0IjogImQ5YWYzY2I0OTM1M2M5MjM2MmUwZjdkOWY5MzdjMTMyODEyZjAyZDNhOTRiMWM2ZWUwNTUyYjdlMzlmMDQ1ZTYiLAogICAgICAgICJuYW1lIjogImV2YWxzL2V2YWxzLmpzb24iLAogICAgICAgICJhbGdvcml0aG0iOiAic2hhMjU2IgogICAgICB9LAogICAgICB7CiAgICAgICAgImRpZ2VzdCI6ICJiZGJhYTYyZDE3N2FjNmQ1Mzc5YjgxNTI3OTczMmEzMzFkMTdlZWI2MWQ0ZjJlNDRmZDJlZDg4ODM5YWMzMGNmIiwKICAgICAgICAibmFtZSI6ICJldmFscy90cmlnZ2VyX2V2YWxzLmpzb24iLAogICAgICAgICJhbGdvcml0aG0iOiAic2hhMjU2IgogICAgICB9LAogICAgICB7CiAgICAgICAgImRpZ2VzdCI6ICJlMjI4ZTM1ZTc0NWNmY2NlNTU4N2YyNjdlZjIxODEwZWVjODQ5YzVhYTA3Y2IxODRjOWUxNmQwZWNiYmE3NGU0IiwKICAgICAgICAibmFtZSI6ICJyZWZlcmVuY2VzL2FwaS5tZCIsCiAgICAgICAgImFsZ29yaXRobSI6ICJzaGEyNTYiCiAgICAgIH0sCiAgICAgIHsKICAgICAgICAiZGlnZXN0IjogImE1YzVjYmJlYjBhYjg0NjQ3MThiOWMwNWRlMDY0MTAyMzQ2YjRkZmNmNzUzMGQ5Yjk3ZDNlMTE4MDI4OGMwNGIiLAogICAgICAgICJuYW1lIjogInJlZmVyZW5jZXMvZXhhbXBsZXMubWQiLAogICAgICAgICJhbGdvcml0aG0iOiAic2hhMjU2IgogICAgICB9LAogICAgICB7CiAgICAgICAgImRpZ2VzdCI6ICJhNTY0MjAxMDczYzc0NTA1MmIzMGI1MDNjYzUxMTkzZGNhOWJlYjlmNmZhOWEwMWVjM2I4MmU1MjMxMTdiOTFkIiwKICAgICAgICAibmFtZSI6ICJyZWZlcmVuY2VzL3BhcmFtZXRlcnMubWQiLAogICAgICAgICJhbGdvcml0aG0iOiAic2hhMjU2IgogICAgICB9LAogICAgICB7CiAgICAgICAgImRpZ2VzdCI6ICJkNmFiZWQxZmM2MjBjMWU0YWZjYWYzY2JlZjJmYTI4OWExMjZkZmUwMDkzODBmMzI3MTgxZGE3ZjM3NmY4ZTU0IiwKICAgICAgICAibmFtZSI6ICJyZWZlcmVuY2VzL3NjaWVuY2UubWQiLAogICAgICAgICJhbGdvcml0aG0iOiAic2hhMjU2IgogICAgICB9LAogICAgICB7CiAgICAgICAgImRpZ2VzdCI6ICI0MzUzNzM5ZWY0ZDg4MzE4MmZjMWYwODg3ZWQyMjdkYTE4NTljNzY2NDJlMGFkNGQ1NTY4YmM1Nzk2ZjM3MTY3IiwKICAgICAgICAibmFtZSI6ICJyZWZlcmVuY2VzL3ZhbGlkYXRpb24ubWQiLAogICAgICAgICJhbGdvcml0aG0iOiAic2hhMjU2IgogICAgICB9LAogICAgICB7CiAgICAgICAgImRpZ2VzdCI6ICI4YmNhNzkxMzEzYjg1MjI0N2M3MzQzMDY3YmUzMmUwYTVhNzkwMmYwY2EwZmIzZDRjNDIzMWQxMGJlYzgyYzA4IiwKICAgICAgICAibmFtZSI6ICJza2lsbC1jYXJkLm1kIiwKICAgICAgICAiYWxnb3JpdGhtIjogInNoYTI1NiIKICAgICAgfQogICAgXQogIH0KfQ==","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MGQCMB9Xj897tOvg325FGnNXoGi+NWcoc4s+tXgJUqX6v0bmEPKTC7eyeodct3kR7RKX6wIwB287ZFvXNfWH2ODQzSLrMY5GM0t8T3Qvcv8/pMCsy/lq52JTNrowOzGIJRZaCU12","keyid":""}]}}
\ No newline at end of file