·
Last changedVersion:
This version passed the hardening gate. Hardening updated the skill content and independently checked the resulting changes. Classified findings before hardening: 6. Classified findings closed: 1. Classified findings remaining: 5. Unclassified scanner findings remaining: 1. Review findings closed: 8. Review findings remaining: 17.
2
4
1
4
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
references/ax-profiles.md | Excessive Agency & Rogue Autonomy | — | Medium | Open | |
SKILL.md | Excessive Agency & Rogue Autonomy | — | Medium | Closed | |
references/ax-setup.md | Supply Chain & Install-Time Trust | Install-time download and execute | Low | Open | |
references/ax-profiles.md | Supply Chain & Install-Time Trust | Install-time download and execute | Low | Open | |
references/ax-setup.md | Malicious Code & Command Execution | — | Low | Open | |
references/ax-profiles.md | Malicious Code & Command Execution | — | Low | Open |
6 findings
openAI, anthropic, awsBedrock)TGxtSW50ZWdyYXRpb246MTI6YUJjRA==); required for evaluator creation and other downstream operationsdefault (provider API key), proxy_with_headers (proxy via custom headers), or bearer_token (bearer token auth)Proceed directly with the task — run the ax command you need.
If an ax command fails, troubleshoot based on the error:
command not found or version error → see references/ax-setup.md401 Unauthorized / missing API key → run ax profiles show to inspect the current profile. If the profile is missing or the API key is wrong, follow references/ax-profiles.md to create/update it. If the user doesn't have their key, direct them to https://app.arize.com/admin > API Keysax spaces list to pick by name, or ask the userax ai-integrations list --space SPACE to check for platform-managed credentials. If none exist, ask the user to provide the key.env files or search the filesystem for credentials. Use ax profiles for Arize credentials and ax ai-integrations for LLM provider keys. If credentials are not available through these channels, ask the user.List all integrations accessible in a space:
Filter by name (case-insensitive substring match):
Paginate large result sets:
Key flags:
| Flag | Description |
|---|---|
| Space name or ID to filter integrations |
| Case-insensitive substring filter on integration name |
| Max results (1–100, default 15) |
| Pagination token from a previous response |
| Output format: |
Response fields:
| Field | Description |
|---|---|
| Base64 integration ID — copy this for downstream commands |
| Human-readable name |
| LLM provider enum (see Supported Providers below) |
|
|
| Allowed model list, or |
| Whether default models for this provider are allowed |
| Whether tool/function calling is enabled |
| Authentication method: |
Use this to inspect an integration's full configuration or to confirm its ID after creation.
Before creating, always list integrations first — the user may already have a suitable one:
If no suitable integration exists, create one. The required flags depend on the provider.
AWS Bedrock uses IAM role-based auth. Provide the ARN of the role Arize should assume via --provider-metadata:
Vertex AI uses GCP service account credentials. Provide the GCP project and region via --provider-metadata:
| Provider | Required extra flags |
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| Flag | Description |
|---|---|
| Allowed model name (repeat for multiple, e.g. |
| Enable the provider's default model list |
| Enable tool/function calling support |
| Authentication type: |
| Custom headers as JSON object (for proxy auth) |
| Provider-specific metadata as JSON object |
Capture the returned integration ID (e.g., TGxtSW50ZWdyYXRpb246MTI6YUJjRA==) — it is needed for evaluator creation and other downstream commands. If you missed it, retrieve it:
update is a partial update — only the flags you provide are changed. Omitted fields stay as-is.
Add --space SPACE when using a name instead of ID.
Warning: Deletion is permanent. Evaluators that reference this integration will no longer be able to run.
Omit --force to get a confirmation prompt instead of deleting immediately.
| Problem | Solution |
|---|---|
| See references/ax-setup.md |
| API key may not have access to this space. Verify key and space ID at https://app.arize.com/admin > API Keys |
| set |
| Verify with |
| Credentials were not saved — re-run |
Evaluator runs fail with LLM errors | Check integration credentials with |
| Cannot change provider after creation — delete and recreate with the correct provider |
arize-evaluatorarize-experimentSee references/ax-profiles.md § Save Credentials for Future Use.
Get started with chainctlchainctl skill install public/github/arize-ai-provider-integration:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/github/skills/arize-ai-provider-integration:latest
MIT
HARDENING.md
LICENSE
SKILL.md
references/ax-profiles.md
references/ax-setup.md