Today, Chainguard published its latest batch of Athena vulnerabilities. They're in widely used open source Java libraries and don't have an official CVE designation or GHSA ID yet, so most scanners won't flag them.

As an Athena shield partner, we got access to the embargoed drop ahead of disclosure. We built, tested, and deployed a policy for Athena members. The policy flags the affected versions in both Maven packages and Docker images that bundle them. 

Today, the flagged vulnerabilities are now public and off embargo, so we're rolling them out to all affected customers.

If you're using any of the affected packages, we'll be in touch with the policy.

If you'd like it anyway, contact your account team or support, and we'll send it over.

We'd suggest starting with a tag action to see what it matches, then switching to quarantine once you're happy.

Chainguard's patched builds aren't flagged.

The full list of vulnerabilities, affected versions, and patches is in 

You can now publish and version the skills and Claude Code plugins your agents use, in the same place you manage your other artifacts. 

Agents follow a skill’s instructions and can run its bundled scripts with the developer’s permissions, so an unvetted skill can lead to prompt injection, data exfiltration or code execution. Access controls and policies let you set which skills and plugins your teams can pull from Cloudsmith. You can also cache skills from GitHub repositories so they keep working if the source changes or is deleted, and install plugins in Claude Code straight from Cloudsmith.

Publish and share skills and Claude Code plugins

 file at its root, plus any supporting scripts, references or assets, following the 

. Upload skills and Claude Code plugins as ZIP archives through the web app, API, or CLI. Each release is versioned with a semantic version or a Git commit SHA and identified by a SHA-256 checksum.

Cloudsmith validates each uploaded archive by checking the frontmatter in SKILL.md. and rejects an upload that fails. A release becomes available to download only after its malware scan completes and your policies allow it.

When you upload a skill, you’ll see two files: the original package and a Claude bundle. The Claude bundle is laid out the way Claude Code expects, so it’s ready to install.

Cache skills and plugins from a GitHub repository

Add a GitHub upstream to your repository with 

 package delivery, and point it at a GitHub repository. Cloudsmith indexes the skills and plugins in that repository and caches each one on first pull. After that, it’s served from Cloudsmith like any other cached package.

You need to provide a GitHub access token to authenticate the upstream, even for public repositories. For a public repository, a token from any GitHub account works. For a private repository, the token needs access to that repository.



Your Cloudsmith repository works as a Claude Code plugin marketplace. Add it once, then install plugins with the commands you already use:

Cloudsmith serves skills only from sources you configure: the GitHub repositories you add as upstreams, and the skills uploaded to your repository.

To block a specific skill or version, add a deny rule matching its name and version. A blocked skill won’t appear when your team lists or pulls skills, and the client gets a “not found” response, as with other formats.

Skills use the same access controls and entitlement tokens as the rest of your Cloudsmith workspace, and appear in the same logs:

 show who pulled which skill and with which token.

 show when a skill was published, quarantined or deleted, and by whom.

 show changes to repository settings and entitlement tokens.

The AI Skills registry is available in Early Access. For more details, see 

Host, version and govern AI skills and Claude Code plugins

Cloudsmith now serves Hugging Face's Tree API, so 

 work through Cloudsmith on huggingface_hub 1.22 and later.

Hugging Face clients download a model in two steps: they list the files in the repository, then fetch each one. From version 1.22, the client gets that list only from the Tree API. Cloudsmith serves the endpoint for both models and datasets.

If a model hasn't been cached in your repository, or hasn't been indexed yet, Cloudsmith fetches its file list from the Hugging Face upstream in real time. The download goes ahead as normal, and the model is indexed for later requests.

Hugging Face downloads now work on huggingface_hub 1.22 and later

Client log exports now contain the format-specific metadata requests your toolchain makes, so you can see the full request chain behind a download. 

Client logs in the web app already show these requests

Metadata requests use the existing log structure.

With format-specific metadata, export volume will increase. A single install can generate several metadata requests per package, so expect more rows than before. If you have questions about this change, 

Log exports are available on Ultra and Enterprise plans. For more details, see 

Client log exports now include metadata requests, not just downloads

Exemptions defined in cooldown policies let specific packages skip the cooldown period and become available immediately, so a new release that fixes a vulnerability doesn’t have to wait. Exempt packages are still evaluated against your other active policies, and any action those policies define still applies.

Add exemptions in the cooldown policy’s Rego (the policy language used by Open Policy Agent) via the Cloudsmith web app, API, or Terraform provider. Each exemption applies to one format and matches by:

Existing policies will continue to work. To add exemptions to one:

 we’ve already migrated these to the new Rego template. Edit the policy in the web app to add exemptions.

Created via the API or Terraform provider:

 we haven’t migrated these to the new template, because doing so would break on the next 

 for Terraform-managed policies. To add exemptions, either delete the policy and recreate it from the updated template, including the policy action that sets the package state to 

, or contact us and we’ll help you migrate it. If you recreate it, do so straight away, because packages held in cooldown become available while no policy exists.

Exempt specific packages from your cooldown policies

Vulnerability records now show how likely each vulnerability is to be exploited, so you can order a backlog of High and Critical findings by what’s likely to be attacked, not just by severity.

The scores come from the Exploit Prediction Scoring System (EPSS), maintained by the Forum of Incident Response and Security Teams (

). EPSS estimates the probability of exploitation in the next 30 days. EPSS data was already available in Cloudsmith’s policies. It now also appears as a score and percentile in vulnerability records on the package 

tab of the Cloudsmith web app, and in the 

EPSS data is available on Ultra and Enterprise plans.

Prioritize vulnerabilities by likelihood of exploitation with EPSS scores

 checks every package against new vulnerability data as soon as it arrives, with no scheduled or manual rescans. It is powered by the 

 (OSV.dev) and has been generally available since August 2026. See 

We are switching Trivy scanning off in stages, starting on 2 November 2026 for workspaces that use it only for upload scans, manual rescans, or recurring scheduled scans. It will be off for all workspaces by 31 March 2027.

If you use Trivy only for upload scans, manual rescans, or recurring scheduled scans

: continuous risk detection covers these automatically. We will switch Trivy off for your workspace on 2 November 2026. No action is needed on your part.

 move your integrations to the OSV endpoints by 31 March 2027.

 data by 31 March 2027. For examples of how to use OSV data in policies, see the policy templates in the web app.

If you use standard vulnerability policies, Datadog security insights, or the 

 these features are moving to OSV.dev. We will be in touch with how to migrate them.

If you use any feature that needs migration, our Customer Success team will contact you to plan the migration and make sure it’s complete before Trivy is switched off for your workspace, no later than 31 March 2027. If you have questions before then, 

Athena Wave 2 - flagging the latest vulnerabilities other scanners can't see

What this means for you

Other logs

Host, version and govern AI skills and Claude Code plugins

Hugging Face downloads now work on huggingface_hub 1.22 and later

Client log exports now include metadata requests, not just downloads

Exempt specific packages from your cooldown policies

Prioritize vulnerabilities by likelihood of exploitation with EPSS scores

Deprecating Trivy vulnerability scanning