agentsclimarketplace
Sign in

Csm setup

Skill cloudsmith-labs/claude-code-skills/skills/csm-setup

Set up, verify, and troubleshoot Cloudsmith access. When fulfilling any request that involves Cloudsmith — finding or publishing packages, checking vulnerabilities or quarantine, creating or simulating policies, managing repositories, upstreams, entitlement tokens, teams, webhooks, quota, or usage metrics — Cloudsmith access MUST be verified first. If Cloudsmith access has not been verified in this session, run this skill before attempting the request, even if no Cloudsmith tooling appears to be available. Also use when the user wants to install the Cloudsmith CLI, log in or authenticate to Cloudsmith, switch organizations or profiles, fix Cloudsmith authentication errors, or point at a self-hosted Cloudsmith API host.From its SKILL.md

Install
npx -y skills add cloudsmith-labs/claude-code-skills --skill csm-setup

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

5.0 KB, as published. Nobody here has run it

Cloudsmith Setup

This plugin talks to Cloudsmith through the official cloudsmith CLI and the Cloudsmith REST API. There is no MCP server: if no Cloudsmith tools are visible, that is normal — do not conclude Cloudsmith is unavailable, and do not send the user to the Cloudsmith website instead. This skill gets access working.

Read ../../references/cloudsmith-core.md before proceeding — it defines the cloudsmith-state check, CLI/REST conventions, and the credential rules ("Stay on script") that apply to every step below.

Procedure

Determine cloudsmith-state (see the shared reference), then follow the flow for that state. Describe everything in plain language; never reveal what was checked.

working

Tell the user they're already set up — report the authenticated user and, if useful, their orgs (from cloudsmith whoami -F json) — then continue with whatever they originally asked for. If they invoked setup explicitly to reconfigure (switch org, profile, or host), continue to the relevant section below instead.

not-installed

  1. Tell the user the Cloudsmith CLI needs to be installed and offer to do it:
    • pipx install cloudsmith-cli (preferred if pipx is available), or
    • pip install --upgrade cloudsmith-cli (requires Python >= 3.10).
  2. Run the chosen install command, then verify with cloudsmith --version. If the version is below 1.16, note that some commands (vulnerabilities, download, SSO auth) need an upgrade.
  3. Continue with the not-setup flow.

not-setup

Present the three authentication options and let the user choose. Do not ask for any credential value in the conversation at any point.

  1. API key (most common). Tell the user to:

    • create or copy an API key at https://app.cloudsmith.com/settings/api-keys
    • then, in their own terminal, either export it (export CLOUDSMITH_API_KEY=... — suggest adding it to their shell profile) or write it to the CLI credentials file by running cloudsmith login (see next option), whichever they prefer.

  2. Email + password login. The user runs cloudsmith login in their own terminal. It prompts for their Cloudsmith email and password, retrieves their API key, and offers to store it in the CLI's config directory. This command is interactive — the user must run it themselves, not the agent.

  3. SAML SSO (orgs with SSO enforced). The user runs cloudsmith auth --owner <org-slug> in their own terminal; it opens the browser for the org's IdP and stores tokens in the OS keyring.

After the user says they've completed one of these, verify with cloudsmith whoami -F json. On success, tell them who they're authenticated as and that Cloudsmith is ready, then continue with their original request. On failure, switch to the not-working flow.

not-working

Credentials exist but aren't working. Present the likely causes together (not one at a time), with the fix for each:

  • Expired SSO session — re-run cloudsmith auth --owner <org-slug>.
  • Revoked or wrong API key — create a fresh key at https://app.cloudsmith.com/settings/api-keys and update it where it's stored (env var or cloudsmith login). If both an env var and a credentials file exist, the env var wins — a stale env var shadows a freshly stored key.
  • Wrong API host — for self-hosted or proxied setups, check CLOUDSMITH_API_HOST / the api_host config value points at the right host.
  • Service issue or rate limiting — run cloudsmith check service and cloudsmith check rates; if Cloudsmith itself is degraded, point at https://status.cloudsmith.com/.

Re-verify with cloudsmith whoami -F json after each fix the user applies.

Switching org, profile, or host

  • Different org: most commands take the org from the OWNER slug, so no reconfiguration is needed — just use the other org's slug. Access is governed by the key's permissions.
  • Multiple accounts: the CLI supports named profiles; the user adds a [profile:<name>] section to their config/credentials files, then skills pass -P <name>. Ask which profile to use when one is set up.
  • Self-hosted host: set via CLOUDSMITH_API_HOST env var or api_host in config.ini. REST calls must then use the same host.

Keep looking

Skills are one crate of 627,801. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.