Formats/AI skills

Manage AI skills like any other dependency

Skills tell your AI agents how to do a job, and agents act on them. Cloudsmith helps you store, version, and govern every skill next to your packages and containers. Your AI agents and agentic workflows can make progress within the guardrails you specify.

Universal format support

One governed home for AI skills. Cloudsmith lets you store, version, and control the skills your agents use.

  • Use AI skills + 30 other formats
  • Host versioned skills, including SKILL.md and supporting files, next to your other artifacts
  • Control which skills your teams can pull, and see how they are accessed

How we support AI skills

Cloudsmith treats each skill as a versioned bundle of files, so you manage it with the same controls you already use for every other package.
    A skills package type
    Host and cache versioned skills, including the SKILL.md file and the scripts, references, and templates around it, next to your other artifacts.
    Upstream proxy for skill sources
    Add the GitHub repositories you trust as upstreams. Teams get public skills through a governed point of control, and only from the sources you chose.
    Policy and allow lists
    Define policies that govern version-aware access to skills, with native support built into the registry. Allow or block skills by name and version.
    Visibility into skill usage
    Skills use the same activity logging as the rest of Cloudsmith, so you can see how each skill is accessed and by whom.
    Publish with the tools you use
    Publish with the web app, the API, or the Cloudsmith CLI, and set who can publish to each repository. Support covers Claude plugins and the Agent Skills spec.

Why teams choose Cloudsmith for AI skills

Agents act on skill instructions and run skill scripts. Cloudsmith gives security a control point and gives developers approved skills without the wait.
Without CloudsmithDevelopers copy skills from public repositories into projects with no record of the source, the version, or who approved it.
With CloudsmithCloudsmith proxies the GitHub repositories you trust. Teams pull skills through the registry, with each release held as a versioned package with a checksum.
Without CloudsmithA risky skill spreads across teams, and there is no quick way to stop it without breaking the skills that are fine.
With CloudsmithAllow or block skills by name and version. Policies govern version-aware access, so you can stop one skill or one release and leave the rest running.
Without CloudsmithSkills live in scattered repositories and folders, separate from the packages and containers your platform team already governs.
With CloudsmithSkills sit in the same multi-format registry as your other artifacts, with the same access controls and activity logging, and no separate tool to run.
Without CloudsmithAI agents use different skills to accomplish the same task, with no guardrails, so results vary from one agent and team to the next.
With CloudsmithCloudsmith is the single source for skills. Every agent works from the same context and instructions, which drives quality and consistency.

Signs you're ready to switch to Cloudsmith for AI skills

If agents in your organization already run skills, these signals say it is time to give them a governed home.
    Agents run skills nobody has reviewed
    Skills change what an agent does and what it touches. A registry gives you one place to decide which sources and versions your teams can use.
    Skills come straight from public sources
    Teams pull community skills straight from GitHub. Cloudsmith serves them through a governed upstream so access follows your policy.
    Teams use different copies of the same skill
    Without versions, teams cannot tell which copy of a skill is running. Cloudsmith publishes each skill once so every team uses the same version.
    You cannot show who is pulling which skill
    Skills use the same activity logging as your other packages, so you can show how each skill is accessed.
    Skills sit outside your artifact platform
    Keeping skills next to your packages and containers means one platform, one set of controls, and one view of what your agents depend on.

Get started with AI skills on Cloudsmith

Frequently asked questions

  1. A skill is a folder with a SKILL.md file in it. The file tells an AI agent how to perform a specific task, and the folder can also contain scripts, references, and templates.

  2. Agents act on skill instructions and run skill scripts, so an unvetted skill can change what an agent does and what it touches. Each skill is a versioned bundle of files, so Cloudsmith can manage it like any other package.

  3. You can publish a skill to a Cloudsmith repository using the web app, the API, or the Cloudsmith CLI. You can also set who can publish to each repository.

  4. Yes. Add the GitHub repositories you trust as upstreams, and teams only get skills from those sources. Cloudsmith serves them through the registry, so access stays under your control.

  5. Yes. Allow and deny lists let you allow or block skills by name and version. Policies govern version-aware access, so you can stop one release without affecting other skills.

  6. Cloudsmith now supports AI skills, including Claude plugins and the Agent Skills spec, which is a SKILL.md file plus scripts, references, and templates. Skills sit in Cloudsmith's multi-format platform alongside your other artifacts.

  7. Yes. Skills use the same activity logging as the rest of Cloudsmith, so you can see how each skill is accessed across your teams.

  8. Yes. Cloudsmith keeps skills next to your packages and containers in the same multi-format registry, so you do not need a separate tool to govern them.

Formats

There’s more than just AI skills on Cloudsmith