--- title: "Host, version and govern AI skills and Claude Code plugins" description: "You can now publish and version the skills and Claude Code plugins your agents use, in the same place you manage your other artifacts. " canonical_url: "https://cloudsmith.com/changelog/host-version-and-govern-ai-skills-and-claude-code-plugins" last_updated: "2026-11-12T17:30:44.583Z" --- # Host, version and govern AI skills and Claude Code plugins You can now publish and version the skills and Claude Code plugins your agents use, in the same place you manage your other artifacts. Agents follow a skill’s instructions and can run its bundled scripts with the developer’s permissions, so an unvetted skill can lead to prompt injection, data exfiltration or code execution. Access controls and policies let you set which skills and plugins your teams can pull from Cloudsmith. You can also cache skills from GitHub repositories so they keep working if the source changes or is deleted, and install plugins in Claude Code straight from Cloudsmith. ```json { "_key": "c47f522ffe9f", "_type": "image", "alt": "The repository view of an AI Skills repository in the Cloudsmith web app.", "asset": { "_createdAt": "2026-11-12T15:08:21Z", "_id": "image-b2e44c5a725e429e7a57a8d50b158454043985ac-1970x1316-png", "_rev": "Cq0WfbdWfPjjye8LFonOLV", "_type": "sanity.imageAsset", "_updatedAt": "2026-11-12T15:08:21Z", "assetId": "b2e44c5a725e429e7a57a8d50b158454043985ac", "extension": "png", "metadata": { "_type": "sanity.imageMetadata", "blurHash": "V5S$r+?a9G?bIV?ws+E2s,WDIVt7M|ofWB.9ogoIWYRj", "dimensions": { "_type": "sanity.imageDimensions", "aspectRatio": 1.4969604863221884, "height": 1316, "width": 1970 }, "hasAlpha": true, "isOpaque": true, "lqip": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAANCAYAAACpUE5eAAAACXBIWXMAAAPoAAAD6AG1e1JrAAABsUlEQVQ4jYVTy47cMAzz/39eTwV6mUOLBdotMJPEessspGSw6APTA+HEskmFVMb7Rtim4hDDwdYra0B9QQP/wQJ54qGOOwn2fcO4H4L7PvHYCcQK9YB5wnMhFv6NRJ8Rc2wUuP0wfP4m+PrOGCyK7SjCCVFD5kIuYOEF1oJ7QM3xmI4vb4pPN8Htu2G4O4QFxAJzb8K6sIr0BVo4F9QS98PwczPsFBgRDhVpUlWFmbd6RP7e6QtiNQerwTwwqqvqbk7CJAaJQqx8DHhcPibgkbDIc69tOa2JVX5GE6oFRoVwsGKb0ivbM+EF9exnsQSpY4qDNFqwaiWghQ4o+n2UWnW1Twarn+nm6k7qUCVZ+7PHKjAlwZbdTdXkqheasFov7+bk9uIZSHlTfqoa5LpAenbcn10WXEmLKkQElcdoU9Xavya8Us7MJqxROuE9e+Xns17hmZeowISQYX8TnmPz0eGTrOB+Jp951j3+JPTyMMEi2I8abEVEtHqtJVSDz/U7yklcpPW5VW9LzCDCUJ4IN4zanETY9gPE3H4+UULM3GNFVMNfXn3Uy7c6QzRBdEBN8As+IfzJG6pEnwAAAABJRU5ErkJggg==", "palette": { "_type": "sanity.imagePalette", "darkMuted": { "_type": "sanity.imagePaletteSwatch", "background": "#202830", "foreground": "#fff", "population": 0, "title": "#fff" }, "darkVibrant": { "_type": "sanity.imagePaletteSwatch", "background": "#ac7914", "foreground": "#fff", "population": 0.02, "title": "#fff" }, "dominant": { "_type": "sanity.imagePaletteSwatch", "background": "#266ddc", "foreground": "#fff", "population": 0.23, "title": "#fff" }, "lightMuted": { "_type": "sanity.imagePaletteSwatch", "background": "#b0cca8", "foreground": "#000", "population": 0, "title": "#fff" }, "lightVibrant": { "_type": "sanity.imagePaletteSwatch", "background": "#76acf9", "foreground": "#000", "population": 0.01, "title": "#fff" }, "muted": { "_type": "sanity.imagePaletteSwatch", "background": "#9f885f", "foreground": "#fff", "population": 0.07, "title": "#fff" }, "vibrant": { "_type": "sanity.imagePaletteSwatch", "background": "#266ddc", "foreground": "#fff", "population": 0.23, "title": "#fff" } }, "thumbHash": "/vcBBYAISbmXkpeUlWaIZFuwpgVr" }, "mimeType": "image/png", "originalFilename": "image1.png", "path": "images/rafvlnhi/production/b2e44c5a725e429e7a57a8d50b158454043985ac-1970x1316.png", "sha1hash": "b2e44c5a725e429e7a57a8d50b158454043985ac", "size": 350547, "uploadId": "b71ea89633a366c1ca475db9ac0189c7f730a05c", "url": "https://cdn.sanity.io/images/rafvlnhi/production/b2e44c5a725e429e7a57a8d50b158454043985ac-1970x1316.png" }, "link": { "_type": "link", "href": null, "openInNewTab": false }, "markDefs": null } ``` ### **Publish and share skills and Claude Code plugins** A skill is a directory with a `SKILL.md` file at its root, plus any supporting scripts, references or assets, following the [Agent Skills specification](https://agentskills.io). Upload skills and Claude Code plugins as ZIP archives through the web app, API, or CLI. Each release is versioned with a semantic version or a Git commit SHA and identified by a SHA-256 checksum. ```json { "_key": "c1cfaad2e9c3", "_type": "image", "alt": "The package Overview tab for an agent skill in the Cloudsmith web app.", "asset": { "_createdAt": "2026-11-12T15:05:04Z", "_id": "image-627066dd26ebe6a6af64dc8a399dcea86d570262-1999x1563-png", "_rev": "EKQ0qZEoxw0zEQISADEQfv", "_type": "sanity.imageAsset", "_updatedAt": "2026-11-12T15:05:04Z", "assetId": "627066dd26ebe6a6af64dc8a399dcea86d570262", "extension": "png", "metadata": { "_type": "sanity.imageMetadata", "blurHash": "VDRpF24n%N?boe_4xuM{WBj[~q-;D%RjbHIVM{ogogay", "dimensions": { "_type": "sanity.imageDimensions", "aspectRatio": 1.2789507357645553, "height": 1563, "width": 1999 }, "hasAlpha": true, "isOpaque": false, "lqip": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAQCAYAAAAWGF8bAAAACXBIWXMAAAPoAAAD6AG1e1JrAAACxElEQVQ4jW2SW28URxCF52cmIJInHnhC+S9BIYQ1KCYEC4koQhC064d4N3lY5cnkIhEpsrzYu96dnZmeS1+quqZP1D1eB+SM9KmqR92nT1VXVjQGtSa01qNzA61laOfhfAAJQB5D/B+09yicRak7NGqDLIrVnYVqDRrtYInh2MOxgHyfYAnwPa5BElAbj5ViFB3DOofMkkdVt7jYltiUCqrp0GoDbSyMtbCOwF7Qh4AAXBHXLD2KxuOfC8JaSbo4i5vrVmNb1ShUg7JuoJoGbdfAWANHBC+XggEfEf857qF0D+MC+gBk0scFQRuXYsI6OGfBzPDSX8G76HtIHyAhtiLGKI70ZX0f4CjWP/QuOt7hI1ciAkq9HSAvsOJhvAf18YLBdSYiaDuNolIoP6JOVBEVc5Vi7C17DxaB8QzNDNq1JDpUdYP5/DccPH+BJ0+fYf+7Z9h/8n3i2w/Zf4oXP/yIP/78C53WyfXOLX/waNlyucTe3mPcvn0Hn974DJ8kbqU8cfPzgRu3cPfuF3j58hWKskwiqXQeiJWGEJBVVYWfj6b45uEevrx3H/e+eoCvH4wwGj1OxMsio9EjHBw8x/HxW7Rtl8qm1HtKkPfJZcbskZcVTs+WOH1/jrPlCptNnlyUieqSEkopaB1HiQccp4mIkxFdxgfOiBnrfIuTxXucLs5wdn6O1eoC6/X6GnmeJ3c7QW0pEXPelRw3HL/9HW/GY7z+6Q3G4zEmkwkODyc4nPxH/DebzXBycgJjbBqbnSClHvaDoNYa7979jdkvv+LoaJoOzWZTTKfXmc/nWCwWqczoaOc0zaxIepiMmYOqm7DZbsMmv2STh02ehzzfhu12IOZFUYau6wIxB2IfHFEg8sFLHxxxUG0XMiYW60hMjMTSGStNZ0QbK45YmEWIJeVxHzELe5+isU6cY/Fe0rnFai3/AqgYo3y+y1DAAAAAAElFTkSuQmCC", "palette": { "_type": "sanity.imagePalette", "darkMuted": { "_type": "sanity.imagePaletteSwatch", "background": "#344454", "foreground": "#fff", "population": 0, "title": "#fff" }, "darkVibrant": { "_type": "sanity.imagePaletteSwatch", "background": "#275cbd", "foreground": "#fff", "population": 0.01, "title": "#fff" }, "dominant": { "_type": "sanity.imagePaletteSwatch", "background": "#5b99f6", "foreground": "#fff", "population": 0.05, "title": "#fff" }, "lightMuted": { "_type": "sanity.imagePaletteSwatch", "background": "#aacec3", "foreground": "#000", "population": 0.03, "title": "#fff" }, "lightVibrant": { "_type": "sanity.imagePaletteSwatch", "background": "#e0cfa4", "foreground": "#000", "population": 0.03, "title": "#000" }, "muted": { "_type": "sanity.imagePaletteSwatch", "background": "#6c8c7c", "foreground": "#fff", "population": 0, "title": "#fff" }, "vibrant": { "_type": "sanity.imagePaletteSwatch", "background": "#5b99f6", "foreground": "#fff", "population": 0.05, "title": "#fff" } }, "thumbHash": "+feFBIAPsXqcdr81dgRZOZBzePiIB4iPAA==" }, "mimeType": "image/png", "originalFilename": "image4.png", "path": "images/rafvlnhi/production/627066dd26ebe6a6af64dc8a399dcea86d570262-1999x1563.png", "sha1hash": "627066dd26ebe6a6af64dc8a399dcea86d570262", "size": 384558, "uploadId": "496311ce211423d5c2c6be36306a4949f0d2f2ac", "url": "https://cdn.sanity.io/images/rafvlnhi/production/627066dd26ebe6a6af64dc8a399dcea86d570262-1999x1563.png" }, "link": { "_type": "link", "href": null, "openInNewTab": false }, "markDefs": null } ``` Cloudsmith validates each uploaded archive by checking the frontmatter in SKILL.md. and rejects an upload that fails. A release becomes available to download only after its malware scan completes and your policies allow it. When you upload a skill, you’ll see two files: the original package and a Claude bundle. The Claude bundle is laid out the way Claude Code expects, so it’s ready to install. ```json { "_key": "fc568a8655e8", "_type": "image", "alt": "The Files tab view for an agent skill in the Cloudsmith web app.", "asset": { "_createdAt": "2026-11-12T15:09:13Z", "_id": "image-3f376b895d4d1536a19eb89bfd2a45377a619018-1978x691-png", "_rev": "pT2an4DloNcLD0UgiBYy4f", "_type": "sanity.imageAsset", "_updatedAt": "2026-11-12T15:09:13Z", "assetId": "3f376b895d4d1536a19eb89bfd2a45377a619018", "extension": "png", "metadata": { "_type": "sanity.imageMetadata", "blurHash": "D8SsBI-pIntTRQ_NNIRjt5V@", "dimensions": { "_type": "sanity.imageDimensions", "aspectRatio": 2.862518089725036, "height": 691, "width": 1978 }, "hasAlpha": true, "isOpaque": true, "lqip": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAHCAYAAAAIy204AAAACXBIWXMAAAPoAAAD6AG1e1JrAAAA+ElEQVQokVWRR3IDMQwE9//f9FUuhWVA5LgG9MryoYsRDYA8vp8DjyY4h6GJo2mgS6BNQ1eH+IIGIIEaP5meuKvgNieereF1+8LxaoJXV3RxTAtoLJgvWFzgjed/eC6RJRZziEwcZ59oQ2vDIhG5EAnEYtCCx6rxSnDJ4gPnvd+4g60N8RKqB/wtpSAL7osFhmYxjRVlJbNIdLGC62PIPhSn1GDuiEzkopRySilkYOKciSZ77nwKz/oDYh44mE2dOKYqRBUeUcJciUwG/gnbJdTcT+GBxzlxP+cWUlale2AKhSydolUE22bLumXn2FVSvj8r8exSMO4HpZEl1ynzSEAAAAAASUVORK5CYII=", "palette": { "_type": "sanity.imagePalette", "darkMuted": { "_type": "sanity.imagePaletteSwatch", "background": "#353d42", "foreground": "#fff", "population": 0.03, "title": "#fff" }, "darkVibrant": { "_type": "sanity.imagePaletteSwatch", "background": "#bf8718", "foreground": "#fff", "population": 0.07, "title": "#fff" }, "dominant": { "_type": "sanity.imagePaletteSwatch", "background": "#bf8718", "foreground": "#fff", "population": 0.07, "title": "#fff" }, "lightMuted": { "_type": "sanity.imagePaletteSwatch", "background": "#b7d6da", "foreground": "#000", "population": 0.03, "title": "#000" }, "lightVibrant": { "_type": "sanity.imagePaletteSwatch", "background": "#f6e096", "foreground": "#000", "population": 0.03, "title": "#000" }, "muted": { "_type": "sanity.imagePaletteSwatch", "background": "#9c7c74", "foreground": "#fff", "population": 0.01, "title": "#fff" }, "vibrant": { "_type": "sanity.imagePaletteSwatch", "background": "#ac6404", "foreground": "#fff", "population": 0, "title": "#fff" } }, "thumbHash": "/vcBAoAINXpWlDVZqQnHBSM=" }, "mimeType": "image/png", "originalFilename": "image2.png", "path": "images/rafvlnhi/production/3f376b895d4d1536a19eb89bfd2a45377a619018-1978x691.png", "sha1hash": "3f376b895d4d1536a19eb89bfd2a45377a619018", "size": 160670, "uploadId": "74f367059d8bec6486aeb3f8467082db1a0c60ac", "url": "https://cdn.sanity.io/images/rafvlnhi/production/3f376b895d4d1536a19eb89bfd2a45377a619018-1978x691.png" }, "link": { "_type": "link", "href": null, "openInNewTab": false }, "markDefs": null } ``` ### **Cache skills and plugins from a GitHub repository** Add a GitHub upstream to your repository with **Package types **set to **Skills and plugins**, configure it with **Cache only** package delivery, and point it at a GitHub repository. Cloudsmith indexes the skills and plugins in that repository and caches each one on first pull. After that, it’s served from Cloudsmith like any other cached package. You need to provide a GitHub access token to authenticate the upstream, even for public repositories. For a public repository, a token from any GitHub account works. For a private repository, the token needs access to that repository. ```json { "_key": "ece361eff511", "_type": "image", "alt": "The 'Configure upstream' form for an AI Skills upstream in the Cloudsmith web app.", "asset": { "_createdAt": "2026-11-12T15:09:40Z", "_id": "image-8a6350f0822866d72a48fc63b10740209d043d8f-1659x1518-png", "_rev": "wShFcTvKnRduO9ho4JwE82", "_type": "sanity.imageAsset", "_updatedAt": "2026-11-12T15:09:40Z", "assetId": "8a6350f0822866d72a48fc63b10740209d043d8f", "extension": "png", "metadata": { "_type": "sanity.imageMetadata", "blurHash": "eDSF|n?F-:t8Ip?YE2M}j=oeE5$~WAWCfl~UM|NHxtf69cxrxta$Rk", "dimensions": { "_type": "sanity.imageDimensions", "aspectRatio": 1.092885375494071, "height": 1518, "width": 1659 }, "hasAlpha": true, "isOpaque": true, "lqip": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAASCAYAAABb0P4QAAAACXBIWXMAAAPoAAAD6AG1e1JrAAACX0lEQVQ4jY2Ta08UMRSG5/ejxhgTP/kjBBNERENi4gcTVjdASADlorhclp1OO23P6e01bXcBcRed5M2ZaafPubZRxmLSSYxbAaU1fAiIKSHEBE0enWEYDuCAf8q6hIachzIGbSfRqR6WGS6EArSc9wiGPDgkuDnimfUR5BMaHyIMUYEJ2cNYgvMeIUZUZwRtGdYFkAvl4A0kpLI2W58CA+wdoCUusFmEnbZFUlOFkwdNoVnWhSIOdW0KZHRKQ/b6D6BhD9EbCGXQ9bZI2VxTX5yRizViH28ibpwP0IYglIbSBuRcgc0iFL0t0BxhjnQiNcadKmt5301htY4JjXURUjtMZD7goHNHff3BcoQ0XGC9dWiVwcHpCFt7hzg6u4AmnqZ+2+lGMyB0wrWKaHWEpATjqrc8Lm1PRVIzxkJj5/AEHwc72D8+Q2/nAOv8AMZVa32F5bpctQp7R2fY/fYDPy8mJf2xUBhdtWilRs6O781ikwCkdKtYlMDO43h0iQ+fh1j/NCjQnHp2RjOnc4a7wYInd/pa9jg4Pcf+yS+cT+T0xiyG8UPAHGkeWGlyQ7iUwMcEH1K1d99DVW7kQmBOn10oMMsO3gfkW5Xnttp7ivE/gD7AEJdhz1Bit9Cy9yWLB4EuRFC5FbOD0xsyx5Kv87u4hhHoKeBSEEYTiwvBGEuPsQx/6UoGXKuAziyIsKabcHzJ2NxRWN3qsPZFYX2o8W6o8X7bYGPblO+st181NncNtk94MVBzwuA74eWGwNLypOjxSounr1s8fyPwbFXgyUqLR8stll61eLEmsDrQ+A1OL3GpL3fGmwAAAABJRU5ErkJggg==", "palette": { "_type": "sanity.imagePalette", "darkMuted": { "_type": "sanity.imagePaletteSwatch", "background": "#2d4352", "foreground": "#fff", "population": 0.02, "title": "#fff" }, "darkVibrant": { "_type": "sanity.imagePaletteSwatch", "background": "#25445c", "foreground": "#fff", "population": 0.02, "title": "#fff" }, "dominant": { "_type": "sanity.imagePaletteSwatch", "background": "#5c778a", "foreground": "#fff", "population": 0.14, "title": "#fff" }, "lightMuted": { "_type": "sanity.imagePaletteSwatch", "background": "#b1c4d0", "foreground": "#000", "population": 0.01, "title": "#fff" }, "lightVibrant": { "_type": "sanity.imagePaletteSwatch", "background": "#74acfc", "foreground": "#000", "population": 0.01, "title": "#fff" }, "muted": { "_type": "sanity.imagePaletteSwatch", "background": "#5c778a", "foreground": "#fff", "population": 0.14, "title": "#fff" }, "vibrant": { "_type": "sanity.imagePaletteSwatch", "background": "#2f6df8", "foreground": "#fff", "population": 0.02, "title": "#fff" } }, "thumbHash": "/fcBDoDLVqc8hpikdvhkGqprrT/h/BM=" }, "mimeType": "image/png", "originalFilename": "image3.png", "path": "images/rafvlnhi/production/8a6350f0822866d72a48fc63b10740209d043d8f-1659x1518.png", "sha1hash": "8a6350f0822866d72a48fc63b10740209d043d8f", "size": 282280, "uploadId": "379d5f741cd2259143a1ac97506df6e0db37064c", "url": "https://cdn.sanity.io/images/rafvlnhi/production/8a6350f0822866d72a48fc63b10740209d043d8f-1659x1518.png" }, "link": { "_type": "link", "href": null, "openInNewTab": false }, "markDefs": null } ``` ### **Install plugins in Claude Code** Your Cloudsmith repository works as a Claude Code plugin marketplace. Add it once, then install plugins with the commands you already use: ```json { "_key": "5bdbd4571434", "_type": "code", "code": "/plugin marketplace add [REPOSITORY_MARKETPLACE_URL]\n/plugin install PLUGIN_NAME@MARKETPLACE_NAME", "filename": null, "language": null, "markDefs": null } ``` This works for private repositories too. ### **Control what your teams can install** Cloudsmith serves skills only from sources you configure: the GitHub repositories you add as upstreams, and the skills uploaded to your repository. To block a specific skill or version, add a deny rule matching its name and version. A blocked skill won’t appear when your team lists or pulls skills, and the client gets a “not found” response, as with other formats. Skills use the same access controls and entitlement tokens as the rest of your Cloudsmith workspace, and appear in the same logs: - **Client logs** show who pulled which skill and with which token. - **Package logs** show when a skill was published, quarantined or deleted, and by whom. - **Audit logs** show changes to repository settings and entitlement tokens. **Get started** The AI Skills registry is available in Early Access. For more details, see [AI Skills registry](https://docs.cloudsmith.com/formats/ai-skills-registry) in the Cloudsmith documentation.