Cloudsmith adds a registry that controls AI agent skills

Cloudsmith, a company that keeps and controls software packages, said it has an AI Agent Skills registry on 9 November 2026 at KubeCon. A skill is a set of instruction documents and scripts that an AI coding agent uses. The registry is in first access. It starts with Claude Code and takes external skills only from GitHub. Cloudsmith gave no test results.

How it works

Each skill release gets a version or a commit code, and a checksum, a code that shows a document did not change. Teams add selected GitHub repositories as sources, and the registry keeps copies. Teams that keep systems safe can stop one skill by name or one version. A stopped item does not show in lists.

The proof

The source gives no test results. Cloudsmith tells that a skill can get repository credentials, internal APIs and production data. Alison Sickelka, its vice president of product, tells: “Community skill registries were built for sharing, not for control.”

What is not known

The Agent Skills specification does not make a version necessary. A skill from Git can change and keep its name. The scope is Claude Code and GitHub only. The source gives no price and no date for full release.

Insight: Agent skills have three layers of control

In October, Cognition released free agent skills that patch faults. In November, CrowdStrike put a sensor in Claude Cowork and added a kill switch. Cloudsmith controls where skills come from. This reads as a race to hold one layer, the source, the operation or the stop, and the layer that all agents must use wins the control. Find who has each layer in your company.