Csm api

Skill cloudsmith-labs/claude-code-skills/skills/csm-api

Call any Cloudsmith REST API endpoint — the escape hatch for Cloudsmith operations not covered by the other skills. Use when the user needs custom package metadata, recycle bin recovery, badges, broadcasts, bulk actions, storage regions, namespace/user info, or any Cloudsmith capability the packages/publish/security/policies/repos/usage skills don't handle.From its SKILL.md

Install

npx -y skills add cloudsmith-labs/claude-code-skills --skill csm-api

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.5 KB, as published. Nobody here has run it

Cloudsmith API (escape hatch)

Read ../../references/cloudsmith-core.md first: verify cloudsmith-state is working (otherwise run the setup skill), use its curl + key-sourcing pattern for every request, and apply its destructive-operation rules to any non-GET call.

Find the right endpoint

Fetch the spec once per session into the scratchpad/temp directory:
- v1 (most of the API, ~360 operations): https://api.cloudsmith.io/v1/swagger/?format=openapi
- v2 (workspaces, custom package metadata, EPM policies): https://api.cloudsmith.io/v2/openapi/?format=json

Search it for the resource, e.g.:

python3 -c "
import json,sys
spec=json.load(open('<tmp>/v1-swagger.json'))
for p,ops in spec['paths'].items():
    for m,op in ops.items():
        if 'recycle' in p or 'recycle' in str(op.get('tags')).lower():
            print(m.upper(), p, '-', op.get('summary',''))
"

Read the matched operation's parameters/schema from the spec before calling — don't guess payload shapes.

v1 tag map (where to look): audit-log, badges, broadcasts, bulk-action, distros, entitlements, files, formats, metrics, namespaces, orgs, packages, quota, rates, recycle-bin, repos, status, storage-regions, user, users, vulnerabilities, webhooks. v2: workspaces (EPM policies), metadata (custom package metadata, including POST /v2/metadata/validate/).

Call it

Use the canonical curl pattern from the shared reference (key sourced in-shell, never printed). Add -D - when you need pagination headers, and -H "Content-Type: application/json" with -d @payload.json for writes (payload written to a temp file).

Rules of the road

Prefer a dedicated skill when one covers the task — this skill is for the long tail.
GETs are free to run; any POST/PUT/PATCH/DELETE gets a plain-language description of what it will change and explicit confirmation first.
On 4xx, show the API's error body (Cloudsmith returns useful detail messages) rather than retrying blind; on 429, wait for the reset.