Cloudsmith Adds AI Agent Skills Registry to Secure the AI Software Supply Chain

Cloudsmith announced an AI Agent Skills registry at KubeCon + CloudNativeCon North America 2026, adding support for hosting, publishing, distributing and governing the skills that AI coding agents use to perform specialized tasks. The registry is part of Cloudsmith’s cloud native artifact repository.

Agent skills typically consist of a SKILL.md file plus scripts, references, templates and other assets. Cloudsmith said that because agents act on those instructions and run those scripts, an unvetted skill can change what an agent does, and skills pulled from public catalogs carry the same unknowns as any open source dependency. Treating each skill as a versioned package lets platform teams manage it like other artifacts.

“Community skill registries were built for sharing, not for control,” said Alison Sickelka, vice president of product at Cloudsmith. “With Cloudsmith, platform teams decide which skills and versions are allowed, block the ones that aren’t, and see every pull in the same audit trail as the rest of their software supply chain.”

The registry adds a skills package type for hosting and caching versioned skills, an upstream proxy for serving public skill sources through a governed point of control, built-in version-aware policy support, allow and deny lists by name and version, and logging through Cloudsmith’s existing observability tools. The capability is available now to Cloudsmith customers, who can add upstreams such as GitHub.