Get Started with the Skills Registry

The JFrog Skills Registry is a centralized hub in the AI Catalog where your coding agent (Claude Code, VS Code with Claude, Cursor, or another harness) publishes, discovers, and installs skill bundles. These are versioned packages of reasoning logic and prompts stored in your organization's Artifactory repositories.

Without the Skills Registry, teams lose track of what exists, reuse the wrong version, or install something that was never scanned.

Skills Registry fixes that with:

• A single place to discover every skill your organization has published
• An Xray scan gate before anything is installable
• Immutable versioned bundles, enabling your agent to know exactly what it's installing

All of this can be handled using agent commands in your IDE. Based on your connected project, the agent automatically resolves the repository so you never have to manage Artifactory paths manually.

How does it work? Publish your skill → Xray scans it → the AI Catalog auto-registers it → your team discovers and installs it.

Prerequisites

• A coding agent configured for your project (Claude Code, VS Code with Claude, Cursor, or another harness).
• JFrog plugins are installed so the agent can use AI Catalog skills.
• JFrog CLI: Install and configure it. See Configure JFrog CLI for Skills.
• Xray indexing must be enabled for the Skills repository. For more information, see Enable Indexing in Xray.

This topic covers the following tasks:

First Time Using the Skills Registry?

Confirm connectivity and publish your first skill using these steps:

1. Verify connectivity: Ask your agent, "What project are you configured for?" to ensure you are connected.
2. Publish your skill: Once you know you're connected to the correct project, follow the Publish a Skill instructions.
3. Wait for the Xray scan to finish: This should only take a few minutes if you are using your project's default repository.
4. Install the skill: Once the scan is complete, install the skill you just published.

That's the entire workflow. Everything past this point can be used as a reference for performing the different steps, including what to do when your agent can't confirm project access (see Skills Registry Troubleshooting).

Publish a Skill

Once your skill folder is ready, ask your agent to publish it. Agent Guard automatically resolves your active project and target repository.

To publish a skill:

1. Prepare a skill bundle: A folder with a SKILL.md file with proper frontmatter, plus any supporting files (prompts, scripts, and so on).

   Required fields:

   SKILL.md

   slug: my-skill
   version: 1.0.0
   description: Brief summary of what the skill does

   • slug: lowercase identifier matching ^[a-z0-9][a-z0-9-]*$.
   • version: semantic version (for example, 1.0.0).
   • description: brief summary (recommended).
     For full skill structure, see Skills Repositories.

2. In your IDE conversation, ask your agent to publish it. For example, ask "Can you publish the skill I just created in /Users/me/projects/my-skill?"

3. Your agent locates the folder, reads SKILL.md for metadata, validates structure, packages the bundle, signs it if configured, resolves your project and repository through Agent Guard, scans it with Xray, publishes it, and reports back the skill's name, version, and repository.

Success Your agent confirms the skill has been published. Note the name and version. You'll need them for discovery and install.

To publish a skill using the JFrog CLI:

1. Run the following command:

   Shell

   jf agent skills publish <PATH_TO_SKILL_FOLDER> --repo <REPOSITORY_NAME>

   Where:

   • <PATH_TO_SKILL_FOLDER>: Path to the skill folder that contains SKILL.md
   • <REPOSITORY_NAME>: Target skills repository name

   For example:

   Shell

   jf agent skills publish ./my-skill --repo my-project-skills-local

   For more information, see Publish Skills with JFrog CLI.

Your skill registers in the Skills Registry immediately. Whether it's installable yet depends on whether it was marked as unsafe in the Xray scan. For more information, see Understanding Skill Status.

Publish with Evidence Signing

With Enterprise+, after you ask to publish, the agent will ask you if you want to attach a cryptographic attestation to a published skill.

See Publish Skills with Evidence Signing.

Discover Skills

Browsing your skills (using your agent or the JFrog Platform) shows every skill published to your active project. Skills are scoped to your project. Contact your administrator if you need skills from another project.

To discover skills using your agent:

• Ask your agent, for example, "What skills are available in our project?" or "Do we have a skill for API testing?" It queries the AI Catalog discovery index at project scope and returns name, version, description, and status for each.

To discover skills using the JFrog Platform:

• Navigate to AI/ML > Discovery > Skills. The JFrog Platform Discovery View shows a grid of skill cards with name, version, description, and status badge. Sorted by Last Updated by default (also: A to Z, Z to A, Created At).

To discover skills using the JFrog CLI:

• Run the following command (to search by name):

  Shell

  jf agent skills list

  For more information, see List Skills.

Inspect a Skill

Using the JFrog Platform, review a skill's metadata, bundle contents, and other details before installing.

To inspect a skill in the JFrog Platform:

• Click a skill card to open the Skill Details Pane (latest version by default). The following details are displayed:
  • The name (linked to Artifactory), version, dates, and Xray status (linked to the scan results).
  • The SKILL.md (purpose, usage, dependencies).
  • The Files tab shows the bundle structure. For more information, see Skills Repositories.

Understanding Skill Status

Every skill uploaded to Artifactory registers in the Skills Registry immediately.

Every auto-provisioned project skills repository has Xray applied by default, so on those repos Not scanned is temporary. Scanning usually completes within minutes, then resolves to Not malicious, Suspicious, or Malicious. If it persists longer than that on an auto-provisioned repo, contact your administrator — it likely means Xray indexing isn't actually enabled on that repository. To enable Xray scanning on this repository, see Enable Indexing in Xray.

Install a Skill

Install a skill after you've inspected it and confirmed its status allows installation.

To install a skill using your agent:

• Ask your agent, for example, "Install the my-skill skill" or "Install version 2.1.0 of api-helper." Your agent verifies status, downloads the bundle, verifies its signature if signed, installs it, and confirms.

To install a skill using the JFrog CLI:

• Run the following command:

  Shell

  jf agent skills install <SKILL_NAME> --harness <HARNESS_NAME> [--repo <REPOSITORY_NAME>] [--version <SKILL_VERSION>]

  Where:

  • <SKILL_NAME>: Name of the skill to install
  • <HARNESS_NAME>: Target agent harness
  • <REPOSITORY_NAME>: (Optional) Skills repository name
  • <SKILL_VERSION>: (Optional) Skill version to install

  For example:

  Shell

  jf agent skills install my-skill --harness cursor

  For more information, see Install Skills with JFrog CLI.

Once installed, your agent recognizes the skill and invokes it as part of normal reasoning. No extra step is required. You can publish from any machine with the skill folder and Agent Guard configured. Once published, it's installable project-wide from anywhere.

Frequently Asked Questions

This section provides answers to frequently asked questions.

Related Topics

• Skills Registry Troubleshooting
• JFrog AI Catalog Overview
• Use the MCP Registry with Agent Guard
• Skills Repositories