Host, version and govern AI skills and Claude Code plugins

You can now publish and version the skills and Claude Code plugins your agents use, in the same place you manage your other artifacts.

Agents follow a skill’s instructions and can run its bundled scripts with the developer’s permissions, so an unvetted skill can lead to prompt injection, data exfiltration or code execution. Access controls and policies let you set which skills and plugins your teams can pull from Cloudsmith. You can also cache skills from GitHub repositories so they keep working if the source changes or is deleted, and install plugins in Claude Code straight from Cloudsmith.

Publish and share skills and Claude Code plugins

A skill is a directory with a SKILL.md file at its root, plus any supporting scripts, references or assets, following the Agent Skills specification. Upload skills and Claude Code plugins as ZIP archives through the web app, API, or CLI. Each release is versioned with a semantic version or a Git commit SHA and identified by a SHA-256 checksum.

Cloudsmith validates each uploaded archive by checking the frontmatter in SKILL.md. and rejects an upload that fails. A release becomes available to download only after its malware scan completes and your policies allow it.

When you upload a skill, you’ll see two files: the original package and a Claude bundle. The Claude bundle is laid out the way Claude Code expects, so it’s ready to install.

Cache skills and plugins from a GitHub repository

Add a GitHub upstream to your repository with Package types set to Skills and plugins, configure it with Cache only package delivery, and point it at a GitHub repository. Cloudsmith indexes the skills and plugins in that repository and caches each one on first pull. After that, it’s served from Cloudsmith like any other cached package.

You need to provide a GitHub access token to authenticate the upstream, even for public repositories. For a public repository, a token from any GitHub account works. For a private repository, the token needs access to that repository.

Install plugins in Claude Code

Your Cloudsmith repository works as a Claude Code plugin marketplace. Add it once, then install plugins with the commands you already use:

/plugin marketplace add [REPOSITORY_MARKETPLACE_URL]
/plugin install PLUGIN_NAME@MARKETPLACE_NAME

This works for private repositories too.

Control what your teams can install

Cloudsmith serves skills only from sources you configure: the GitHub repositories you add as upstreams, and the skills uploaded to your repository.

To block a specific skill or version, add a deny rule matching its name and version. A blocked skill won’t appear when your team lists or pulls skills, and the client gets a “not found” response, as with other formats.

Skills use the same access controls and entitlement tokens as the rest of your Cloudsmith workspace, and appear in the same logs:

• Client logs show who pulled which skill and with which token.
• Package logs show when a skill was published, quarantined or deleted, and by whom.
• Audit logs show changes to repository settings and entitlement tokens.

Get started

The AI Skills registry is available in Early Access. For more details, see AI Skills registry in the Cloudsmith documentation.