Cloudsmith announced an AI Agent Skills registry on November 9, 2026, at KubeCon, extending its artifact-management platform to the instruction files and scripts used by AI coding agents. The release adds controls for skill sources, versions and access alongside existing software packages.
Skills and Claude plugins now sit in Cloudsmith’s multi-format repositories, which the company says support more than 30 artifact formats. The registry is opening to customers in early access, with documentation available.
Agent Skill Security Risks
A skill is organized around a SKILL.md file containing a required name and description plus instructions for the agent. Optional folders can add scripts, reference material and templates; a Claude plugin packages skills so they can be installed together. A skill can therefore supply both directions and executable code for tasks such as following a review process or querying an internal tool.
Cloudsmith’s technical post published November 6, 2026 describes the access at stake: repository credentials, internal APIs and production data, depending on how the agent is configured. Bundled scripts can inherit those privileges when run, or receive permissions a user grants when the agent requests approval.
A malicious, altered or flawed skill could consequently expose data, execute harmful commands or take unintended actions. Its instructions can also direct the agent to install packages, creating another route for unreviewed dependencies.
Versioning presents a separate problem. The Agent Skills specification does not require a version, so a skill pulled from Git can change while keeping the same name. That complicates efforts to identify the exact release an agent retrieved or apply an approval to a specific release.
Alison Sickelka, Cloudsmith’s vice president of product, said: “Community skill registries were built for sharing, not for control.” She described the missing enterprise information as publisher identity, the version agents are running and whether anyone approved the skill.
Registry Publishing and Access Controls
Cloudsmith treats each skill release as a package. A release receives either a semantic version or a Git commit SHA, together with a SHA-256 checksum. Repositories can remain private or be shared publicly, and developers can discover skills in the same repositories as other artifacts.
Authors can upload through the web application, API or Cloudsmith command-line interface. The product page specifies Write or Admin privileges on the destination repository for publishing, with permissions assignable to users, teams or service accounts. Publishing a release once lets teams pull the same version, subject to repository controls.
For external skills, teams add selected GitHub repositories as upstreams and authenticate with a token. Cloudsmith caches skills and plugins from those repositories, including private repositories when the token has access. Teams pulling through that configuration receive skills only from publishers represented by the chosen upstreams.
Deny rules provide a narrower control than rejecting an entire repository. Security teams can block a named skill or one version while leaving the rest of a trusted source available. A blocked item disappears from list and pull results, and attempts to retrieve it return a nothing found error.
Skills also use Cloudsmith’s existing activity and audit logging. The trail records which skills and versions are pulled, while Cloudsmith provides visibility into current versions, origins and access across repositories. This places agent-skill activity in the same audit record as other software artifacts.
Claude Code and GitHub at Launch
A Cloudsmith repository can also function as a Claude Code plugin marketplace. Developers add the repository once, then install plugins within a session using /plugin install.
Cloudsmith says it is beginning its AI-artifact work with Claude Code and using GitHub as the first upstream source. The launch brings the agent’s instructions and scripts under the same dependency controls as the packages they may install; the release’s present scope is Claude Code, with GitHub as the source for cached external skills.
Credit: Source link
