Cloudsmith launched an AI Skills Registry on November 9, 2026, treating agent skills and Claude plugins as first-class versioned artifact types alongside packages and containers [1][1]. The move directly targets a documented enterprise pain point: 44.7% of SLE decision-makers cite lack of governance and control infrastructure as a top-three barrier to expanding AI use [2]. Cloudsmith positions the registry as the control plane that converts ungoverned shadow AI into auditable, policy-enforced infrastructure [3].
What is Covered in this Article
- Shadow AI risk: agent skills spreading faster than governance can track [1]
- AI Skills Registry capabilities: versioning, checksums, deny rules, and audit logging [1][1]
- Market validation: governance gaps and audit logging mandates among SLE decision-makers [2][2]
- Emerging control-plane category: agent identity, registries, and policy gateways [3]
- Cloudsmith's enterprise growth opportunity from a strong practitioner foundation [4][4]
The News: Cloudsmith announced its AI Skills Registry on November 9, 2026, opening early access beginning with Claude Code [1][1]. The registry lets teams manage agent skills and Claude plugins as artifact types alongside packages and containers in Cloudsmith's platform, which already supports more than 30 artifact formats [1][1]. Each skill release receives a semantic version or git commit SHA plus a SHA-256 checksum, and skills share the same audit logging as every other format [1]. Teams can add GitHub repositories as upstream sources, with Cloudsmith caching skills and plugins including from private repositories [1]. Deny rules allow blocking a specific skill or version by name without removing the entire upstream, returning a 'nothing found' error to developers [1]. Cloudsmith repositories also function as a Claude Code plugin marketplace, where developers install plugins in their session with /plugin install [1].
Cloudsmith Brings Governed Control to the Agent Skills Supply Chain
Analyst Take: Cloudsmith's AI Skills Registry arrives at a precise inflection point. Agent skills are replicating the shadow-IT pattern of early cloud computing, spreading through Slack, email, and Git repositories faster than any governance process can track [1]. The registry gives platform engineering a single system of record to close that gap before it becomes a material supply chain liability [3].
The Shadow AI Problem Is a Software Supply Chain Problem
A skill is a bundle of instructions and resources, structured as a SKILL.md file plus the scripts, references, and templates an agent loads for a specific job [1]. When those skills spread informally, organizations lose visibility into which versions agents are running, who authored them, and whether anyone reviewed them. The consequences are concrete: a malicious, changed, or simply incorrect skill can cause an agent to leak data, run harmful commands, or take unintended actions using whatever access the agent already holds [1]. This mirrors the early cloud era, when useful tools propagated team by team while IT spent years reconstructing what was running where. The difference now is that agents act autonomously on those instructions, compressing the window between deployment and harm.
Four Capabilities That Close the Governance Gap
Cloudsmith's registry addresses the problem through four interlocking controls. First, skills and Claude plugins are hosted as versioned artifact types, each release carrying a semantic version or git commit SHA plus a SHA-256 checksum [1]. Second, GitHub upstream caching lets teams pull from trusted sources, including private repositories, without bypassing the registry [1]. Third, deny rules block a specific skill or version by name without removing the entire upstream, so security can act surgically rather than broadly [1]. Fourth, skills share the same unified audit logging as every other format in Cloudsmith, giving security teams a single trail across the full software supply chain [1]. Because Cloudsmith already supports more than 30 artifact formats, skills sit in the same system of record as packages and containers rather than a separate silo [1].
Survey Data Confirms the Market Is Ready to Buy
Futurum's 2H 2026 SLE decision-maker survey makes the demand signal explicit. Lack of governance and control infrastructure ranks first as a top-three factor limiting expanded AI use, cited by 44.7% of respondents [2]. Security and compliance requirements rank first overall at 48.0% [2]. Nearly half, 45.1%, already mandate audit logging of agent actions [2], which maps directly to the unified audit trail Cloudsmith delivers. Vendor and tooling fragmentation ranks as a top-three limiter for 58.8% of respondents [2], reinforcing the value of consolidating skills alongside packages and containers in one platform. Looking forward, AI-assisted secure and govern tooling ranks as a top-three evaluation priority for 55.2% of organizations in the next 12 months [2], indicating active buying intent for the category Cloudsmith is entering.
A Distinct Control-Plane Category Is Taking Shape
Cloudsmith's move reflects a broader structural shift in how enterprises think about AI infrastructure. Agent identity, registries, and policy-in-the-loop gateways now constitute a distinct control-plane category, the machinery that converts shadow AI into governable infrastructure [3]. This is not an extension of existing DevSecOps tooling; it is a new budget line forming at the intersection of platform engineering and security. The Software Lifecycle Engineering market is forecast to reach $343.97 billion (343,965.17 USD millions) by 2028 at a 15.4% CAGR from 2023 [5], and AI artifact governance is positioned to capture a meaningful share of that spend as organizations formalize their agent deployment practices.
Strong Practitioner Trust, Enterprise Scale Still Ahead
Cloudsmith enters this category with credibility. Its G2 star rating stands at 4.54 (4.544444444444444) with an NPS of 71.11 as of 2026 Q3 [4], scores that reflect genuine practitioner satisfaction rather than marketing momentum. However, the reviewer distribution tells a growth story: of 45 reviewed accounts, 17 are small business, 16 are mid-market, and only 9 are enterprise [4]. The security and platform engineering budget owners who will control AI skills governance spend sit predominantly in that enterprise segment. Converting that practitioner trust into enterprise-scale deployments, where governance, compliance, and audit requirements are most acute and contract values are highest, represents the clearest path to category leadership.
What to Watch
- Early access conversion: how quickly teams in the Claude Code early access cohort progress to production deployments and whether enterprise accounts lead that adoption [1]
- Enterprise segment expansion: whether Cloudsmith's G2 enterprise reviewer count grows materially from its current 9 accounts as AI skills governance becomes a formal procurement category [4]
- Upstream source breadth: which additional upstream sources beyond GitHub Cloudsmith adds in Q1 2027, given that GitHub was built first based on customer demand [1]
- Competitive registry response: how existing DevSecOps and artifact management vendors reprice or extend their platforms to address agent skills governance over the next two quarters
- Buying intent conversion: whether the 55.2% of organizations planning to evaluate AI-assisted secure and govern tooling in the next 12 months translate into active procurement cycles that Cloudsmith can capture [2]
Sources
1. Give your agent skills a trusted control plane, Cloudsmith, November 2026
2. 2H 2026 Software Lifecycle Engineering Global Enterprise Decision Maker Survey Report, Futurum Research, July 2026
3. Futurum Signal Report | Data Intelligence Platforms – August 3, 2026, Futurum Research, August 2026
4. G2 Review Data: Cloudsmith
5. 2H 2026 Software Lifecycle Engineering Market Sizing & Five-Year Forecast, Futurum Research, July 2026
Disclosure: Futurum is a research and advisory firm that engages or has engaged in research, analysis, and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article.
Read the full Futurum Group Disclosure.
Author Information
This content is written by a commercial general-purpose language model (LLM) along with the Futurum Intelligence Platform, and has not been curated or reviewed by editors. Due to the inherent limitations in using AI tools, please consider the probability of error. The accuracy, completeness, or timeliness of this content cannot be guaranteed. It is generated on the date indicated at the top of the page, based on the content available, and it may be automatically updated as new content becomes available. The content does not consider any other information or perform any independent analysis.
