Try JFrog
Guides
Contact SupportTry JFrog
  1. SKILLS REGISTRY

Govern the Skills Registry

Use policies to control which skills can run in a project.

Preview Feature

Everything on this page — policy evaluation and the block messages below — can only be applied when Preview mode is enabled for Skills Enforcement.

To enable Preview mode:

A primary admin enables Preview mode in MyJFrog → Settings → Previews. Once enabled, policies will be applied. When Preview mode is not enabled, policies can still be created and viewed, but a skill will never actually be blocked at invocation, regardless of what policies exist.

Governing the Skills Registry includes the security scan that decides whether a skill is installable, and the controls you apply on top of it. That scan is powered by JFrog Xray; for scan status and the install flow, see Get Started with Skills Registry. On top of the scan, policies apply your organization or project rules.

See Manage Skill Policies for how policies work and how to create them. When a policy blocks a skill, see Manage Skill Waivers.

Prerequisites

  • Everything required for the Skills Registry itself: agent configuration, JFrog CLI, and security scanning enabled on the skills repository. See Get Started with Skills Registry.

  • Skills enforcement enabled via the Preview toggle — see the note above. Policies exist independently of this, but have no effect until it's on.

  • Project administrator permissions to create or edit policies. Organization-wide policies require Global administrator permissions.

  • Developer role on the project, so you can read skill artifacts from Artifactory. Model Developer and Model Governor do not include this access on their own. For instructions, see Assign Members to a Project.

  • Model Developer role, to submit an unknown* (never-scanned) skill for governance approval from a local machine. Assign this role in addition to Developer.

  • Model Governor role, to use an unknown skill immediately, without waiting for a scan. Assign this role in addition to Developer.

* Unknown = Not in artifactory/unscanned.

📘

Note

  • Project members with the Model Governor role can use unknown skills without scanning or policy checks.
  • Project members with the Model Developer role can try to use an unknown skill. The skill is scanned and evaluated against defined policies.
  • Project members without Model Developer or Model Governor can use an unknown skill only after they publish it and it is successfully scanned.
  • In all cases, reading skill artifacts from Artifactory also requires the project Developer role. Without it, you can see skills in the project but cannot read them.

Govern Skills with Policies

Use policies to decide which skills can run in a project.

Manage Skill Policies >

Create, view, edit, and delete the rules that allow or block skills.

Manage Skill Waivers >

Request, review, cancel, or revoke an exception for a blocked skill

Interpret Skill Block Messages

After policies are in place, a coding agent that invokes a blocked skill returns a message. Use that message to see which policies matched. To request an exception, see Manage Skill Waivers.

When a coding agent invokes a skill that is blocked by policy:

✖ Skill blocked: <SKILL_NAME>
<N> polic{y/ies} violated in <PROJECT>:
- <POLICY_NAME_1>
- <POLICY_NAME_2>

Where:

  • <SKILL_NAME>: Skill the agent tried to invoke
  • <PROJECT>: Project where governance was evaluated
  • <POLICY_NAME_1>, <POLICY_NAME_2>: Policies that blocked the skill

For example:

✖ Skill blocked: api-helper
2 policies violated in my-project:
- Block unscanned — No completed scan
- Manual Allow-List — Version is not on the project allow-list
plusMessages that are not policy violations

These states are not policy violations.

Security scan in progress

✖ Skill blocked: <SKILL_NAME>
This skill is still being scanned by Xray and isn't available yet.
Try again shortly.

Semantic scan in progress

✖ Skill blocked: <SKILL_NAME>
This skill is undergoing semantic scanning and isn't available yet.
Semantic scans typically take a few minutes. Try again shortly.

Missing permission to submit for scanning

✖ Can't submit this skill for review
Your account doesn't have the Model Developer role needed to request a governance evaluation.
Ask your JFrog admin to grant it, then try again.

Frequently Asked Questions

This section provides answers to frequently asked questions about Skills Registry governance.

plusFAQs
Q: Where do I create policies?

A: In the JFrog Platform, go to AI/ML > Policies. See Manage Skill Policies​.

Q: Why can I see skills in the project but not read them?

A: The Model Developer role does not include Artifactory read access. Assign the project Developer role in addition to Model Developer (or Model Governor). Seeing a skill listed is not the same as being able to read the skill bundle.

Q: Does Cursor keep a blocked skill's content isolated once it's blocked?

A: Not fully. Cursor loads a skill's full content into the chat's context as soon as it's available, independent of its scan or policy status — this is a Cursor platform behavior outside JFrog's governance. If you need a blocked or unverified skill's content to stay out of context, start a new chat (a new context window) before continuing.

Related Topics

Updated 7 days ago

Did this page help you?