Agent skill · nvidia
tao-data-io
The data-mover for TAO jobs — decides the storage tier (A pre-positioned mount with zero fetch / B volume-from-S3 / C ephemeral in-compute fetch), stages inputs (bulk + annotation-selective + archive extract + HF/NGC PTM), maps credentials to env, routes outputs 3-way with upload-excludes, and runs the compute-frame verify gate. A support skill other platform skills (docker, kubernetes, slurm, brev, virtualenv) call to get data to and from the compute container without the TAO SDK. Trigger phrases include "stage inputs", "mount the dataset", "upload TAO results", "download only referenced files", "resolve results_dir", "verify the container can read the data".
What it needs
About 3k tokens when loaded.
What this skill does
tao-data-io Get data to and from the compute container. Decide the storage tier first — under strategy A (pre-positioned mount) no bytes move at all — and when a fetch is needed, move it host-side with aws/s5cmd/boto3/huggingface-cli/ngc directly — no nvidia-tao-sdk, no in-container runtime. Other platform skills call this skill to stage inputs before launch and sync outputs after. It never launches a container itself. The chosen tier is stamped into the job-record at submit. When NOT to invoke this skill: if the inputs are already readable from the compute frame (a local path on the execution host, an existing Lustre/PVC/bind mount), that IS tier A — record it and skip this skill entirely; there is nothing to move. Air-gapped hosts: tier A is the only tier — never attempt an S3/HF/NGC fetch; anything missing (datasets, checkpoints, and the container images themselves) must be pre-positioned by the operator, and the preflight's readability check is the only data step that runs. Credentials (env vars; values never written to disk by this skill) S3 credentials use the officially documented AWS env vars, read from the session environment: AWSACCESSKEYID, AWSSECRETACCESSKEY, and (for S3-compatible stores) AWSENDPOINTURL, AWSDEFAULTREGION. The aws CLI and boto3 pick the variables up natively — never run aws configure and never write ~/.aws/credentials: If a session provides only the legacy TAO names (ACCESSKEY, SECRETKEY, S3ENDPOINTURL, CLOUDREGION), map them once, scoped to the command: AWSACCESSKEYID="$ACCESSKEY" AWSSECRETACCESSKEY="$SECRETKEY" aws s3 ... HFTOKEN / NGCKEY pass through unchanged for PTM pulls. Never pass a credential as a CLI argument (-p, --token, -e KEY=value); use --password-stdin or -e VAR (no value). Storage strategy (agent decides; the gate verifies) Pick per backend from what the cluster/daemon actually offers: A — pre-positioned mount (PVC / NFS / Lustre / bind mount already holding the data): mount it, author the mount paths into the spec. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills nvidia/tao-data-io