{"slug": "cloudsmith-adds-ai-agent-skills-registry-to-secure-the-ai-software-supply-chain", "title": "Cloudsmith Adds AI Agent Skills Registry to Secure the AI Software Supply Chain", "summary": "Cloudsmith announced an AI Agent Skills registry at KubeCon + CloudNativeCon North America 2026, adding a skills package type to its cloud native artifact repository so platform teams can host, publish, distribute and govern the SKILL.md files and scripts that AI coding agents execute. The registry includes an upstream proxy for public skill sources, version-aware policy support, allow and deny lists by name and version, and pull logging through Cloudsmith's existing observability tools; the capability is available now to Cloudsmith customers, who can add upstreams such as GitHub. \"Community skill registries were built for sharing, not for control,\" said Alison Sickelka, vice president of product at Cloudsmith.", "body_md": "# Cloudsmith Adds AI Agent Skills Registry to Secure the AI Software Supply Chain\n\nCloudsmith announced an AI Agent Skills registry at KubeCon + CloudNativeCon North America 2026, adding support for hosting, publishing, distributing and governing the skills that AI coding agents use to perform specialized tasks. The registry is part of Cloudsmith’s cloud native artifact repository.\n\nAgent skills typically consist of a SKILL.md file plus scripts, references, templates and other assets. Cloudsmith said that because agents act on those instructions and run those scripts, an unvetted skill can change what an agent does, and skills pulled from public catalogs carry the same unknowns as any open source dependency. Treating each skill as a versioned package lets platform teams manage it like other artifacts.\n\n“Community skill registries were built for sharing, not for control,” said Alison Sickelka, vice president of product at Cloudsmith. “With Cloudsmith, platform teams decide which skills and versions are allowed, block the ones that aren’t, and see every pull in the same audit trail as the rest of their software supply chain.”\n\nThe registry adds a skills package type for hosting and caching versioned skills, an upstream proxy for serving public skill sources through a governed point of control, built-in version-aware policy support, allow and deny lists by name and version, and logging through Cloudsmith’s existing observability tools. The capability is available now to Cloudsmith customers, who can add upstreams such as GitHub.", "url": "https://wpnews.pro/news/cloudsmith-adds-ai-agent-skills-registry-to-secure-the-ai-software-supply-chain", "canonical_source": "https://cloudnativenow.com/kubecon-cloudnativecon-north-america-2026/cloudsmith-adds-ai-agent-skills-registry-to-secure-the-ai-software-supply-chain/", "published_at": "2026-11-09 14:55:28+00:00", "updated_at": "2026-11-09 15:24:15.246242+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "ai-infrastructure"], "entities": ["Cloudsmith", "Alison Sickelka", "KubeCon + CloudNativeCon North America 2026", "GitHub"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/cloudsmith-adds-ai-agent-skills-registry-to-secure-the-ai-software-supply-chain", "markdown": "https://wpnews.pro/news/cloudsmith-adds-ai-agent-skills-registry-to-secure-the-ai-software-supply-chain.md", "text": "https://wpnews.pro/news/cloudsmith-adds-ai-agent-skills-registry-to-secure-the-ai-software-supply-chain.txt", "jsonld": "https://wpnews.pro/news/cloudsmith-adds-ai-agent-skills-registry-to-secure-the-ai-software-supply-chain.jsonld"}}