Try JFrog
Guides
Contact SupportTry JFrog
  1. SKILLS REGISTRY

Govern the Skills Registry

Use policies to control which skills can run in a project.

⚠️

Note — Preview feature

Everything on this page — policy evaluation and the block messages below — can only be applied when Preview mode is enabled for Skills Enforcement. A primary admin must enable Preview mode in MyJFrog → Settings → Subscriptions → Previews for policies to have an effect. Without it, policies can still be created and viewed, but a skill will never actually be blocked at invocation, regardless of what policies exist.

Governing the Skills Registry includes the security scan that decides whether a skill is installable, and the controls you apply on top of it. That scan is powered by JFrog Xray; for scan status and the install flow, see Get Started with Skills Registry. On top of the scan, policies apply your organization or project rules.

See Manage Skill Policies for how policies work and how to create them.

Prerequisites

  • Everything required for the Skills Registry itself: agent configuration, JFrog CLI, and security scanning enabled on the skills repository. See Get Started with Skills Registry.
  • Skills enforcement enabled via the Preview toggle — see the note above. Policies exist independently of this, but have no effect until it's on.
  • Project administrator permissions to create or edit policies. Organization-wide policies require Global administrator permissions.
  • Model Developer permission, to submit an unknown* (never-scanned) skill for governance approval from a local machine. For instructions how to add a member with the Model Developer role for a project, see Assign Members to a Project.
  • Model Governor permission to use an unknown skill immediately, without waiting for a scan. For instructions how to add a member with the Model Governor role for a project, see Assign Members to a Project.

* Unknown = Not in artifactory/unscanned.

📘

Note - Exceptions:

  • Project members with Model Governor role can use unknown skills without scanning or policy checks.
  • Project members with Model Developer role can try to use an unknown skill. In this case, the skill will be scanned and it will be checked against defined policies to evaluate if it can be used or not.
  • Project members without either Model developer or Model Governor role are only able to use an unknown skill after they publish it and it is successfully scanned.

Govern Skills with Policies

Use policies to decide which skills can run in a project.

Manage Skill Policies >

Create, view, edit, and delete the rules that allow or block skills.

Interpret Skill Block Messages

After policies are in place, a coding agent that invokes a blocked skill returns a message. Use that message to see which policies matched.

When a coding agent invokes a skill that is blocked by policy:

✖ Skill blocked: <SKILL_NAME>
<N> polic{y/ies} violated in <PROJECT>:
- <POLICY_NAME_1>
- <POLICY_NAME_2>

Where:

  • <SKILL_NAME>: Skill the agent tried to invoke
  • <PROJECT>: Project where governance was evaluated
  • <POLICY_NAME_1>, <POLICY_NAME_2>: Policies that blocked the skill

For example:

✖ Skill blocked: api-helper
2 policies violated in my-project:
- Block unscanned — No completed scan
- Manual Allow-List — Version is not on the project allow-list
plusMessages that are not policy violations

These states are not policy violations.

Security scan in progress

✖ Skill blocked: <SKILL_NAME>
This skill is still being scanned by Xray and isn't available yet.
Try again shortly.

Semantic scan in progress

✖ Skill blocked: <SKILL_NAME>
This skill is undergoing semantic scanning and isn't available yet.
Semantic scans typically take a few minutes. Try again shortly.

Missing permission to submit for scanning

✖ Can't submit this skill for review
Your account doesn't have the Model Developer role needed to request a governance evaluation.
Ask your JFrog admin to grant it, then try again.

Frequently Asked Questions

This section provides answers to frequently asked questions about Skills Registry governance.

plusFAQs
Q: Where do I create policies?

A: In the JFrog Platform, go to AI/ML > Policies. See Manage Skill Policies​.

Q: Does Cursor keep a blocked skill's content isolated once it's blocked?

A: Not fully. Cursor loads a skill's full content into the chat's context as soon as it's available, independent of its scan or policy status — this is a Cursor platform behavior outside JFrog's governance. If you need a blocked or unverified skill's content to stay out of context, start a new chat (a new context window) before continuing.

Related Topics

Updated 8 days ago

Did this page help you?