AI skills registry

Manage your agent skills like any other dependency

Let your teams adopt agent skills quickly while you control which ones your agents pull. Govern skills and plugins in the same control plane as your other artifacts, with the policies and audit logs you already use.

INTRODUCING AI SKILLS REGISTRY

Control every agent skill your teams pull

Manage skills and Claude plugins in the same control plane as your packages and containers, with the policy engine and audit logs you already use.
    Host, publish, and version your own skills
    Store the skills your teams write next to your packages and containers. Publish a skill once and every team uses the same version.
    Pull public skills through an upstream
    Add the GitHub repositories you trust as upstreams. Your teams only get skills from those sources, cached in Cloudsmith.
    Give security a full view
    See every skill's current version, where it came from, and who accesses it across all your repositories.
    Block individual skills by name or version
    Trust a whole repository and still block a single skill or version with a deny rule. Blocked skills don't appear when teams list or pull.
WE'RE HERE TO HELP

What teams run into as agent skills spread

Skills spread between teams before anyone reviews them

Developers, analysts, and operations teams all write and pull agent skills to automate their work. The useful ones get shared quickly.

Skills are scattered across platforms

Teams pull skills from Git repositories, community catalogs, and standalone registries. Each one has its own way to publish, version, and control access, so it's hard to see what agents pull, audit which skills are in use, or block a bad skill everywhere at once.

Skills carry the risk of any open source dependency

A skill is a bundle of instructions and scripts that agents use, often with the same access as the developer running the agent. When it comes from a public source, you don't know who wrote it, what changed, or if anyone approved it. A malicious, changed, or simply wrong skill can make an agent leak data, run harmful commands, or take actions no one intended.

Agents pull different versions of the same skill

Agents on different teams end up on different versions of the same skill. To approve or block skills quickly, security needs to see which versions agents pull.

Built for every team that touches agent skills

    Platform leads
    Pull agent skills from the same repositories as your packages and containers. Govern skills like any open-source dependency, in the repositories you already use, and pull public skills only from the GitHub repositories you choose.
    Security leads
    Decide where your agents' skills come from and block the ones you don't want. See every skill and version your teams pull across all your repositories, and block individual skills in a trusted repository by name or version.
    Engineering and security leadership
    Scale agent skills across every team on your terms. Security chooses the sources teams pull skills from, and teams use them without waiting on sign-off for each skill.
    Developers and skill authors
    Write your skill around a SKILL.md file, then publish it once so every team uses the same version. Publish from the CLI you already use, and set who can publish to each repository. Developers find approved skills in the repositories they already use.

Agent skills and AI artifact security guides

Frequently asked questions

  1. A skill is a folder with a SKILL.md file in it. The file tells an AI agent how to perform a specific task, and the folder can also contain scripts and reference files.

  2. MCPs connect an agent to external systems such as databases and APIs. A skill teaches the agent how to do a task.

  3. Treat them like any open-source dependency. A skill can include scripts, and agents may run them with access to sensitive systems, so it matters who wrote a skill and which version you’re pulling. Cloudsmith lets you control which skills your teams can pull and shows how those skills are accessed.

  4. It’s where you store, version, and control the skills your agents use. Cloudsmith AI Skills Registry keeps them next to your packages and containers, so you don’t need a separate tool.

  5. Add the GitHub repositories you trust as upstreams, and teams only get skills from those. You can also add deny rules to block a skill by name or version, even when you trust the rest of the repository.

  6. Publish the skill once to a Cloudsmith repository, and everyone pulls the same version from there. You can upload via the web app or the API, and access controls determine who can publish.

  7. Yes. Add a GitHub repository as an upstream with a token, and Cloudsmith caches its skills and plugins. Private repositories work too, as long as the token has access.

  8. Claude Code is supported today

  9. Yes. You can host Claude plugins alongside your skills, and developers can add them in Claude Code using /plugin install.

  10. Yes. Skills use the same activity logging as the rest of Cloudsmith, so you can see how each skill is accessed.

  11. The AI Skills Registry adds support for Claude plugins and the Agent Skills spec (SKILL.md plus scripts, references, and templates) to Cloudsmith's multi-format registry.

  12. You can publish a skill to a Cloudsmith repository using the web app, the API, or the Cloudsmith CLI. Give each release a version, either a semantic version or a git commit SHA, and your teams pull it from there. Access controls determine who can publish.

  13. Anyone with Write or Admin privileges on the repository. Set privileges for each repository and grant them to specific users, teams, or service accounts. Skills pulled from a GitHub upstream don’t need anyone to publish them, because Cloudsmith caches them when your teams pull them.

See the AI Skills Registry in action