Cloudsmith secures the AI software supply chain with agent skills registry support

KubeCon, 9 November 2026 -- Cloudsmith, the leading cloud-native artifact management and software supply chain platform, today announced its AI Agent Skills registry, an important step for enterprises seeking to secure and control the AI software supply chain. Agent skills, which are bundles of instructions and resources that AI coding agents use to perform specialized tasks, have become critical tools for software development.

The new first-class registry, part of Cloudsmith's cloud-native artifact repository, supports hosting, publishing, distributing, and governing AI skills. Cloudsmith keeps agent skills in the same multi-format repositories alongside other first- and third-party artifacts that are relevant for a project team, deployment target, or organizational entity.

Agentic tool workflows broaden the software developer population in today’s enterprises. Analysts, operations staff, and other citizen developers author and use skills to automate work, including scripts for agents to run. Useful tools spread quickly, and organizations need a common way to control, secure, and distribute skills. When stored across Git repositories, community catalogs, and standalone registries, it can be challenging to control publishing, authentication, and versioning. Using Cloudsmith as an AI Skills Registry provides visibility for which skills exist, which version is current, and which skills are approved.

Alison Sickelka, VP of Product at Cloudsmith, said: "Community skill registries were built for sharing, not for control. Enterprises can’t say who published a skill, which version their agents are running, or whether anyone approved it, and an agent will act on whatever that file tells it to do. With Cloudsmith, platform teams decide which skills and versions are allowed, block the ones that aren’t, and see every pull in the same audit trail as the rest of their software supply chain."

Skills show agents how to do a specific job, such as following a team's review process or working with an internal tool. AI skills consist of a SKILL.md file, plus scripts, references, templates, and other assets it needs to run. Agents act on those instructions and run those scripts, so an unvetted skill can change what an agent does and what it touches. Pulled from public catalogs, a skill also carries the same unknowns as any open source dependency: who wrote it, whether it has changed, and whether anyone reviewed it. That is why enterprises typically require governance for AI skills, as they do for other coding artifacts. Because each skill is a versioned bundle of files, an artifact registry can manage it like any other package.

With skills centralized in Cloudsmith, platform engineering teams govern them in one place, controlling access for developers with a single source of truth, full versioning, control over access privileges, and audit observability.

Cloudsmith’s AI skills support includes:

• Skills package type: Host and cache versioned skills, including SKILL.md and supporting files, next to your other artifacts
• Upstream proxy: Serve public skill sources through the registry, so teams access community skills from a governed point of control
• Built-in policy support: Define policies that govern version-aware access to skills, with native support built into the registry
• Allow and deny lists: Allow or block skills by name and version
• Logging and observability: Skills are included in Cloudsmith's existing observability tools, so you can see how they are accessed, used, and managed alongside your other artifacts

Cloudsmith’s AI Skills registry, along with the relevant documentation, is now available to Cloudsmith customers. Teams can add agentic-skill upstreams, such as GitHub, push and pull skills, and add visibility of and governance for agentic skill usage to their environment and organization.