Cloudsmith Extends Artifact Registry Reach to AI Skills

James Matchett, head of security for Cloudsmith, said the AI Agent Skills registry provides access to a set of vetted skills to ensure that application development teams are not inadvertently using an AI skill that might include a set of malicious prompts. While it’s not clear to what degree software engineering teams are making use of AI skills, a survey of 505 engineers in the U.S. and United Kingdom conducted by Cloudsmith finds 83% are relying on platforms for managing software artifacts that were not built for the AI era even though they already identify malicious dependencies being added to AI-generated code as the top threat to software supply chains. The AI Agent Skills registry minimizes that risk by hosting skills, including SKILL.md and supporting files, next to other software artifacts. DevSecOps teams can then define policies that govern usage of the AI skills, including making use of allow and deny lists that block an AI skill by name and version.