---
updatedAt: 2026-08-10T07:46:09.000Z
agentTools:
siteIndex: https://docs.jfrog.com/llms.txt
projectIndex: https://docs.jfrog.com/artifactory/llms.txt
---
# Skills Repositories
**Note**
Skills repositories is an open beta feature.
Skills is a package type in JFrog Artifactory for sharing and consuming AI agent capabilities (skills) compatible with the ClawHub protocol. Artifactory acts as a private skill registry so teams can publish, discover, and install skills from a single place.
Artifactory supports local Skills repositories with the following capabilities:
* **Private skill storage**: Host and share your own skills in local repositories.
* **REST API**: Publish and download skills using the ClawHub v1βcompatible API.
* **Metadata and search**: Artifactory indexes skills and populates the Packages UI from `SKILL.md` manifests.
* **JFrog CLI (**`jf agent skills`**)**: Full command reference for publish, install, search, update, list, and delete, including flags, harness install paths, and environment variables. For more information, see [JFrog CLI for Skills](/artifactory/docs/jf-skills).
## Get Started with Skills
To get started working with Skills repositories using the JFrog CLI, complete the following main steps:
1. [Create Skills Repository](#create-skills-repository)
2. [Configure JFrog CLI for Skills](#connect-package-type-to-artifactory)
3. [Publish](#publish-skills-with-jfrog-cli), [install](#install-skills-with-jfrog-cli), [search](/artifactory/docs/jf-skills#search-skills), [update](/artifactory/docs/jf-skills#update-a-skill), [list](/artifactory/docs/jf-skills#list-skills), and [delete](#delete-skills) skills
For information about working with Skills repositories via REST API, see [REST API for Skills Repositories](#rest-api-for-skills-repositories).
## Create Skills Repository
This topic describes how to create a Skills repository. This is required before deploying and resolving skills. Artifactory supports local Skills repositories to store and share first- and second-party packages and artifacts with your organization.
For more information, see [Repository Management](https://docs.jfrog.com/artifactory/docs/repository-management).
**Prerequisite**: You need Admin or Project Admin permissions in Artifactory to create a repository.
**To create a Skills repository**:
1. In the **Administration** tab, click **Repositories > Create a Repository**.
2. Select **Local**.
3. Select the **Skills** package type.
4. In the **Repository Key** field, type a meaningful name for the repository. For example, `skills-local`. For more information on local repositories and their settings, see Local Repositories.
5. Click **Create Repository**. The repository is created and the Repositories window is displayed.
## Configure JFrog CLI for Skills
You can work with Skills repositories in Artifactory through the JFrog CLI (`jf`) or REST API. To use `jf agent skills`, you first have to configure the CLI to use your Artifactory server for Skills.
**Note**
The JFrog CLI command for Skills repositories is `jf agent skills`. `jf skills` is the original version of the namespace from JFrog CLI version 2.98.0.
**Prerequisites**:
* JFrog CLI v2.98.0 or newer downloaded and installed on your machine. For more information, see [Install JFrog CLI](https://jfrog.com/getcli/).
You can verify your JFrog CLI installation with the command `jf --version`.
* A Skills local repository.
**To configure JFrog CLI for use with Skills repositories:**
1. Run the following command to add your Artifactory server:
```shell
jf config add \
--url \
--access-token \
--interactive=false
```
Where:
* ``: A name of your choice for the new server
* ``: The URL of your JFrog Platform
* ``: Your Artifactory identity token
For example:
```shell
jf config add skills \
--url https://company.jfrog.io \
--access-token Random_Token18Hrug38Wfskuyig45 \
--interactive=false
```
2. Run the following commands to set the server as your default and verify the configuration:
```shell
jf config use
jf config show
```
Where `` is the name you assigned to your Skills server. For example:
```shell
jf config use skills
jf config show
```
**Note**
You can also use JFrog Set Me Up to copy the snippet populated with your token and environment. For more information, see [Use Artifactory Set Me Up for Configuring Package Manager Clients](/artifactory/docs/use-artifactory-set-me-up-for-configuring-package-manager-clients).
**Next steps:**
* [Publish Skills with JFrog CLI](#publish-skills-with-jfrog-cli)
* [Install Skills with JFrog CLI](#install-skills-with-jfrog-cli)
## Publish Skills with JFrog CLI
When publishing skills with the `jf agent skills publish` command, the version is read from the `version` field in the `SKILL.md` frontmatter. You can optionally specify a version, or [publish with evidence signing](#publish-skills-with-evidence-signing).
If you have JFrog AI Catalog, you can enable security scanning to check uploaded skills for malicious code before distribution and consumption. For more information, see [Skill Scanning](/security/docs/skill-scanning).
**To publish a skill to Artifactory:**
* Run the following command:
```shell
jf agent skills publish --repo
```
Where:
* ``: The path to the skill folder on your local machine
* ``: The name of your local Skills repository in Artifactory
For example:
```shell
jf agent skills publish ~/skills_dev/myskill --repo skills-local
```
For all flags and environment variables, see [`jf agent skills publish`](/docs/jf-skills#publish-a-skill).
**Tip**
To override the automatically detected version, use the `--version` flag and specify the version number.
**Note**
You can also use JFrog Set Me Up to copy the snippet populated with your token and environment. For more information, see [Use Artifactory Set Me Up for Configuring Package Manager Clients](/artifactory/docs/use-artifactory-set-me-up-for-configuring-package-manager-clients).
### Publish Skills with Evidence Signing
With Enterprise+, you can publish skills with evidence signing to attach a cryptographic attestation to the published artifact.
**To publish skills with evidence signing:**
* Run the following command:
```shell
jf agent skills publish --repo \
--signing-key ./private.key \
--key-alias my-evd-key
```
Where:
* ``: The path to the skill folder on your local machine
* ``: The name of your local Skills repository in Artifactory
For example:
```shell
jf agent skills publish ~/skills_dev/myskill --repo skills-local \
--signing-key ./private.key \
--key-alias my-evd-key
```
Alternatively, you can set `EVD_SIGNING_KEY_PATH` and `EVD_KEY_ALIAS` environment variables.
**Note**
You can also use JFrog Set Me Up to copy the snippet populated with your token and environment. For more information, see [Use Artifactory Set Me Up for Configuring Package Manager Clients](/artifactory/docs/use-artifactory-set-me-up-for-configuring-package-manager-clients).
**Next steps:**
* [Install Skills with JFrog CLI](#install-skills-with-jfrog-cli)
* [Delete Skills](#delete-skills)
## Install Skills with JFrog CLI
You can install skills using `jf agent skills install`. During installation, `jf agent skills install` automatically verifies evidence using public keys stored in Artifactory. No local signing keys are needed on the installer's side.
If verification fails:
* **Interactive terminal**: You are prompted to proceed or abort.
* **CI or **`--quiet`** mode**: The install fails automatically. Set `JFROG_SKILLS_DISABLE_QUIET_FAILURE=true` to convert the failure to a warning and proceed.
One of `--harness` or `--path` is required. Use `--repo` to specify the Skills repository (or rely on auto-discovery when only one Skills repository exists).
Canonical syntax (from `jf agent skills install --help`):
```shell
jf agent skills install \
(--harness [--project-dir ] | --harness --global | --path ) \
[--repo ] \
[--version ]
```
**To install skills using JFrog CLI:**
* Run one of the following commands:
* To install a specific version for a harness:
```shell
jf agent skills install --harness [--repo ] [--version ]
```
Where:
* ``: The name of the skill to install
* ``: The name of the target Skills repository
* ``: The harness to install for (for example, `cursor`)
* ``: The version of the skill to install
For example:
```shell
jf agent skills install myskill --repo skills-local --harness cursor --version 1.0.0
```
* To install the latest version:
```shell
jf agent skills install --harness [--repo ] [--version latest]
```
Where:
* ``: The name of the skill to install
* ``: The name of the target Skills repository
* ``: The harness to install for
For example:
```shell
jf agent skills install myskill --repo skills-local --harness cursor --version latest
```
**Note**
The `--version latest` flag resolves to the greatest available SemVer in the repository.
* To install to a custom local path (mutually exclusive with `--harness`, `--global`, and `--project-dir`):
```shell
jf agent skills install --path [--repo ] [--version ]
```
Where:
* ``: The skill slug to install (CLI argument name: `slug`)
* ``: Local filesystem base directory; the skill is installed at `/`. The base directory must already exist.
* ``: Optional Skills repository key. If omitted, the CLI auto-discovers a local Skills repository when possible.
* ``: Optional SemVer or `latest`. If omitted, the CLI resolves the highest available SemVer.
For example:
```shell
jf agent skills install myskill --path ./vendor/skills --repo skills-local --version latest
```
For all install modes, supported harnesses, and flags, see [`jf agent skills install`](/docs/jf-skills#install-a-skill).
**Note**
You can also use JFrog Set Me Up to copy the snippet populated with your token and environment. For more information, see [Use Artifactory Set Me Up for Configuring Package Manager Clients](/artifactory/docs/use-artifactory-set-me-up-for-configuring-package-manager-clients).
## Additional Skills Repository Information
The following pages provide additional information about using Skills repositories in Artifactory:
* [Working with JFrog CLI for Skills](#working-with-jfrog-cli-for-skills)
* [Delete Skills](#delete-skills)
* [Metadata and Package Identification](#metadata-and-package-identification)
* [REST API for Skills Repositories](#rest-api-for-skills-repositories)
### Working with JFrog CLI for Skills
Use the `jf agent skills` namespace to publish, install, search, update, list, and delete skills in Skills repositories. For every command, flag, supported harness, and environment variable, see [JFrog CLI for Skills](/artifactory/docs/jf-skills).
### Delete Skills
Use `jf agent skills delete` to remove a specific skill version from a Skills repository. This is useful when you need to remove deprecated, incorrect, or blocked versions while keeping other versions of the same skill.
**To delete a skill version:**
* Run the following command:
```shell
jf agent skills delete --version [--repo ]
```
Where:
* ``: The skill slug to delete
* ``: The version to delete
* ``: The Skills repository key. If omitted, CLI can auto-discover it when only one Skills repository is available.
For example:
```shell
jf agent skills delete myskill --version 1.0.0 --repo skills-local
```
The command deletes the selected version path from the repository. There is no interactive confirmation prompt.
**Tip**
To verify the target without deleting it, use `--dry-run`:
```shell
jf agent skills delete myskill --version 1.0.0 --repo skills-local --dry-run
```
The output shows what would be deleted.
For all flags, see [`jf agent skills delete`](/artifactory/docs/jf-skills#delete-a-skill).
### Metadata and Package Identification
Artifactory treats each stored zip as a skill package at path `{slug}/{version}/{slug}-{version}.zip`. It extracts skill identity and metadata from:
* **Path**: The `slug` and `version` are taken from the storage path.
* **SKILL.md**: When the zip contains a file named **SKILL.md**, Artifactory parses the YAML frontmatter (the block between the first `---` and the next `---`). It supports the metadata blocks `metadata.skills`, `metadata.clawdbot`, and `metadata.clawdis`. From that it populates package properties and the Packages UI (for example, name, description, version, author, tags, displayName, summary, changelog).
#### Artifactory Property Keys
Metadata is stored as Artifactory properties under the `skill.*` namespace, including: `skill.name`, `skill.version`, `skill.description`, `skill.author`, `skill.tags`, `skill.displayName`, `skill.summary`, `skill.changelog`, `skill.fingerprint`, and others.
**Note**
The Packages page is for browsing and discovery. It is not a replacement for ClawHub client behavior or version resolution.
### REST API for Skills Repositories
This section contains information for how to work with Skills repositories using REST API.
* [Configure Client or Scripts for Skills Repositories](#configure-client-or-scripts-for-skills-repositories)
* [Deploy Skills via REST API](#deploy-skills-via-rest-api)
* [Check Scan Status for a Skill](#check-scan-status-for-a-skill)
* [Install Skills via REST API](#install-skills-via-rest-api)
* [Get a Single File](#get-a-single-file)
* [Additional API Endpoints](#additional-api-endpoints)
#### Configure Client or Scripts for Skills Repositories
To use Skills with Artifactory, configure your client or scripts with the registry URL and credentials.
**Prerequisites**:
* A local Skills repository (see [Create Skills Repository](#create-skills-repository)).
* A client that can send HTTP requests (for example, `curl`, or a ClawHub-compatible CLI).
**Configuration**:
The registry base URL for your Skills repository is:
```
https://:@/artifactory/api/skills/
```
Where:
* ``: Your Artifactory username
* ``: Your Artifactory identity token or password
* ``: Your JFrog Platform URL
* ``: The repository name
**Discovery (optional)**:
You can request the well-known discovery document for auto-discovery. This endpoint allows anonymous access:
```
GET https:///artifactory/api/skills//.well-known/clawhub.json
```
**Note**
Only the `.well-known/clawhub.json` endpoint allows anonymous access. All other Skills endpoints (list, download, publish, resolve) require Artifactory credentials. Use credentials in the URL, an Artifactory token, or `.netrc` as described in Artifactory authentication documentation.
#### Deploy Skills via REST API
Publishing a skill uploads a zip bundle to the repository. The server expects a multipart form with a JSON payload and one or more files. It builds the zip and stores it at `{slug}/{version}/{slug}-{version}.zip`.
**Endpoint**:
```
POST https:///artifactory/api/skills//api/v1/skills
```
**Content-Type**: `multipart/form-data`
**Required parts**:
* **payload**: JSON object with at least:
* `slug` (string): Skill identifier. **Mandatory** pattern: lowercase letters, digits, and hyphens only. The slug must start with a letter or digit (`^[a-z0-9][a-z0-9-]*$`).
* `version` (string): Version of the skill (for example, semantic version).
Optional fields: `displayName`, `summary`, `changelog`, `tags`.
* **files\[]**: One or more file parts. The server bundles them into a zip. Include a file named **SKILL.md** so Artifactory can extract metadata for the Packages UI and search.
**Mandatory naming**: The stored zip path is `{slug}/{version}/{slug}-{version}.zip`. The slug must match the pattern described in the payload requirements.
**Mandatory for metadata**: The zip should contain a file named **SKILL.md** (at root or in a subdirectory). Artifactory parses the YAML frontmatter in SKILL.md to populate the Packages UI and search. If SKILL.md is missing, the package is still stored but metadata may be incomplete.
**Example** (publish a skill):
```shell
curl -X POST -u ":" \
-F 'payload={"slug":"my-skill","version":"1.0.0"}' \
-F 'files[]=@SKILL.md' \
-F 'files[]=@src/action.js' \
"https:///artifactory/api/skills//api/v1/skills"
```
**Note:** Replace ``, ``, ``, and `` with your values. You can use **Set Me Up** in Artifactory to obtain a pre-filled snippet where applicable.
#### Check Scan Status for a Skill
Checks the semantic scan gate status for a published skill artifact path in the repository. This endpoint is served by the Artifactory Skills package handler and returns the current scan verdict for the requested artifact.
```
GET https:///artifactory/api/skills//xrayStatus?path=
```
**Mandatory query parameter**:
* `path`: URL-encoded in-repository artifact path (for example, `my-skill/1.0.0/my-skill-1.0.0.zip`).
**Status values**:
* `NOT_IN_ENTITLEMENT`: Skills Xray entitlement is not enabled. Caller can skip scan polling.
* `XRAY_DISABLED_FOR_REPO`: Xray scanning is disabled for this repository.
* `SCAN_IN_PROGRESS`: Scan is still running. Caller should poll until a terminal status is returned.
* `APPROVED`: Artifact passed the scan gate.
* `BLOCKED`: Artifact was identified as malicious or violating policy.
**Example** (check scan status):
```shell
curl -u ":" \
"https:///artifactory/api/skills//xrayStatus?path=my-skill%2F1.0.0%2Fmy-skill-1.0.0.zip"
```
Example response:
```json
{
"status": "APPROVED",
"repoKey": "skills-local",
"path": "my-skill/1.0.0/my-skill-1.0.0.zip"
}
```
**Note**
This endpoint uses `api/skills/{repoKey}/xrayStatus` and does not include the `/api/v1/` segment used by most other Skills endpoints.
#### Install Skills via REST API
You can download a skill by slug and version, resolve a version by fingerprint (hash), or fetch a single file (for example, SKILL.md).
##### Download by Slug and Version
Returns the skill as a zip archive.
```
GET https:///artifactory/api/skills//api/v1/download?slug=&version=
```
**Example** (download skill zip):
```shell
curl -u ":" -o my-skill.zip \
"https:///artifactory/api/skills//api/v1/download?slug=my-skill&version=1.0.0"
```
##### Download by Fingerprint
Resolves a skill version by its bundle fingerprint (SHA-256 hash). Returns JSON with the resolved version information.
```
GET https:///artifactory/api/skills//api/v1/resolve?slug=&hash=
```
**Mandatory**: `hash` must be a 64-character lowercase hexadecimal SHA-256 fingerprint.
**Example** (resolve version by fingerprint):
```shell
curl -u ":" \
"https:///artifactory/api/skills//api/v1/resolve?slug=my-skill&hash=<64-char-hex>"
```
#### Get a Single File
Download one file from a skill version (for example, SKILL.md).
```
GET https:///artifactory/api/skills//api/v1/skills//file?version=&path=
```
**Example** (fetch SKILL.md from a skill version):
```shell
curl -u ":" \
"https:///artifactory/api/skills//api/v1/skills/my-skill/file?version=1.0.0&path=SKILL.md"
```
#### Additional API Endpoints
The following endpoints are available for listing, searching, and inspecting skills.
| Action | Method | Endpoint |
| -------------- | ------ | -------------------------------------------------- |
| List skills | GET | `.../api/v1/skills?limit=200&cursor=&sort=updated` |
| Skill detail | GET | `.../api/v1/skills/{slug}` |
| List versions | GET | `.../api/v1/skills/{slug}/versions` |
| Version detail | GET | `.../api/v1/skills/{slug}/versions/{version}` |
| Search | GET | `.../api/v1/search?q=&limit=20&offset=0` |
Search `limit` is clamped between one and 100. Default sort for list is `updated`.
**Examples**:
List skills (first page, sort by updated):
```shell
curl -u ":" \
"https:///artifactory/api/skills//api/v1/skills?limit=200&sort=updated"
```
Example response:
```json
{
"items": [
{
"slug": "my-skill",
"displayName": "My Skill",
"summary": "Does something useful.",
"updated": "2025-01-15T10:30:00Z",
"versions": 3
},
{
"slug": "other-skill",
"displayName": "Other Skill",
"summary": "Another capability.",
"updated": "2025-01-14T08:00:00Z",
"versions": 1
}
],
"nextCursor": "eyJvZmZzZXQiOjJ9",
"total": 2
}
```
Skill detail (metadata for one skill):
```shell
curl -u ":" \
"https:///artifactory/api/skills//api/v1/skills/my-skill"
```
Example response:
```json
{
"slug": "my-skill",
"displayName": "My Skill",
"summary": "Does something useful for your agent.",
"tags": ["automation", "tools"],
"versions": 3,
"latestVersion": "1.2.0",
"updated": "2025-01-15T10:30:00Z"
}
```
List versions for a skill:
```shell
curl -u ":" \
"https:///artifactory/api/skills//api/v1/skills/my-skill/versions"
```
Example response:
```json
{
"slug": "my-skill",
"versions": [
{
"version": "1.2.0",
"fingerprint": "a1b2c3d4e5f6...",
"published": "2025-01-15T10:30:00Z",
"changelog": "Added new action."
},
{
"version": "1.1.0",
"fingerprint": "f6e5d4c3b2a1...",
"published": "2025-01-10T14:00:00Z",
"changelog": "Bug fixes."
},
{
"version": "1.0.0",
"fingerprint": "1234567890ab...",
"published": "2025-01-01T09:00:00Z"
}
]
}
```
Version detail (metadata for one version):
```shell
curl -u ":" \
"https:///artifactory/api/skills//api/v1/skills/my-skill/versions/1.0.0"
```
Example response:
```json
{
"slug": "my-skill",
"version": "1.0.0",
"displayName": "My Skill",
"summary": "Does something useful.",
"fingerprint": "a1b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef123456",
"changelog": "Initial release.",
"published": "2025-01-01T09:00:00Z",
"downloadUrl": ".../api/v1/download?slug=my-skill&version=1.0.0"
}
```
Search skills by query:
```shell
curl -u ":" \
"https:///artifactory/api/skills//api/v1/search?q=my-query&limit=20&offset=0"
```
Example response:
```json
{
"results": [
{
"slug": "my-skill",
"version": "1.2.0",
"displayName": "My Skill",
"summary": "Does something useful.",
"match": "summary"
},
{
"slug": "my-other-tool",
"version": "2.0.0",
"displayName": "My Other Tool",
"summary": "Related to my-query.",
"match": "slug"
}
],
"total": 2,
"limit": 20,
"offset": 0
}
```
## Limitations of Skills Repositories in Artifactory
The following are limitations of Skills repositories in Artifactory:
* **Slug format**: When working with the API, slugs must match `^[a-z0-9][a-z0-9-]*$` (lowercase letters, digits, and hyphens. The slug must start with a letter or digit).
* **Metadata parsing**: The maximum size for parsing a `SKILL.md` file is 5 MB. Larger files are not parsed for metadata.
* **Local repositories only**: Remote and virtual Skills repositories are currently not supported.
* **No server-side dependency resolution**: Artifactory serves artifacts and metadata only. Dependency resolution is performed by the ClawHub-compatible client.