Skills
Skills in Venue.sh are reusable AI workflow instructions—step-by-step guidance that coding agents load when a task matches the skill's trigger conditions. Venue.sh automatically discovers and catalogs skills from your connected Git repositories.
Skills follow the agentskills.io specification. You do not register skills manually. Venue.sh finds them during repository content ingestion and keeps the catalog in sync as repositories change.
Key Capabilities
- Discovery
- Browse skills discovered across your organization's connected repositories.
- Search
Filter by name or description keywords.
- Inspection
- View skill metadata, including triggers, author, version, license, and companion content inventory.
- Reading
View the rendered markdown from each skill's
SKILL.mdfile.- Skill Guard
- Automatically scan each skill for security risk when it is first discovered, and rescan it whenever its content changes.
- Assistant integration
- Ask the Assistant about available skills and their Skill Guard security assessments using natural language.
Discovered skills are also synced to the software catalog as skill entities, so you can relate them to components and other catalog entities.
Browsing Skills
- Open Skills from the sidebar (under AI).
- Use the search box to filter by name or description.
- Click a skill to open its detail page.
The list shows each skill's name, description, source repository, and when it was last updated.
Skills are discovered automatically when repository content ingestion finds SKILL.md files in connected repositories. New skills appear after the next ingestion run. Removed skills are dropped from the catalog when their SKILL.md file is deleted.
For prerequisites and configuration, see AI Settings.
Viewing Skill Details
Each skill detail page shows the following information:
- Metadata
- Name, description, trigger summary, author, version, license, compatibility, and allowed tools (when present in frontmatter).
- Companion content inventory
Which optional directories exist alongside the skill (
scripts/,references/,agents/,assets/,rules/) and how many files each contains.- Source
- The repository and directory path where the skill was discovered.
- Skill body
The rendered markdown content from
SKILL.md.
The trigger summary is extracted from phrases like "Use when..." in the skill description or body, helping you quickly see when an agent should load the skill.
Skill Guard
Skills carry instructions that agents execute automatically, so an unreviewed skill can be a security risk. Skill Guard scans each skill for issues such as prompt injection attempts, unsafe commands, and credential exposure, and shows the result on the skill's detail page.
A Venue administrator configures Skill Guard under . Once configured, Venue.sh scans a skill automatically the first time it is discovered, and scans it again whenever its content changes during repository reprocessing. You do not need to trigger a scan yourself.
Viewing a Skill's Security Assessment
- Open a skill from the Skills list.
- Click the Skill Guard tab.
A security assessment - A risk score, a recommendation (Safe to use, Use with caution, or Do not install), and a list of findings with corresponding severity (Critical, High, Medium, or Low). Filter findings by severity using the chips above the list.
Scan in progress - The skill was discovered recently, and Skill Guard has not finished scanning it yet.
Scan failed - The scan did not complete. Venue.sh explains the reason, such as a scanning service timeout or a rejected AI credential.
Not configured - Skill Guard has no model selected for your organization. A link to AI Settings lets an administrator configure one.
Reviewing Assessment History
Enterprise organizations can review a skill's prior assessments, not just its current one, directly via . Each row shows when the assessment completed and its risk score. Click a row to expand and see that assessment's full findings, exactly as they were recorded at the time.
Assessment History helps you track whether a skill is getting safer or riskier over time, especially after its maintainers make changes in response to a prior finding.
Authoring Skills in Your Repository
To make a skill discoverable in Venue.sh, add a skill directory to a connected repository with a SKILL.md file at its root. The filename is matched case-insensitively (SKILL.md or skill.md).
Directory structure
A skill is a directory, not a single file. The minimum requirement is SKILL.md. Optional companion directories provide supporting material:
my-skill/
├── SKILL.md # Required - skill definition and instructions
├── scripts/ # Optional - executable scripts the agent can run
├── references/ # Optional - reference documents
├── agents/ # Optional - agent definitions
├── assets/ # Optional - images, templates, or other assets
└── rules/ # Optional - rule filesVenue.sh catalogs the companion directory inventory and file counts. It does not ingest the full content of companion files into the Skills catalog.
SKILL.md format
SKILL.md uses YAML frontmatter followed by markdown body content:
---
name: my-skill
description: Short summary of what this skill does. Use when the user asks to sync mkdocs navigation.
license: Apache-2.0
compatibility: Cursor, Claude Code
metadata:
author: Platform Team
version: '1.0'
allowed-tools: bash, read, write
---Frontmatter fields
| Field | Required | Description |
|---|---|---|
| name | Yes | Lowercase identifier (letters, numbers, hyphens; max 64 characters) |
| description | Recommended | Brief summary (max 1024 characters). Include "Use when..." to define trigger conditions |
| license | No | SPDX license identifier or free text |
| compatibility | No | Which agents or tools the skill supports (max 500 characters) |
| metadata | No | Key-value map for additional fields such as author and version |
| allowed-tools | No | Tools the skill expects the agent to use (experimental) |
If frontmatter is missing or incomplete, Venue.sh derives the skill name from the directory name and extracts a description from the first paragraph of the markdown body.
Common locations
.cursor/skills/<skill-name>/SKILL.md- Cursor plugin and workspace skillsskills/<skill-name>/SKILL.md- Repository-level skills
Skills with the same name in different repositories are treated as separate catalog entries, disambiguated by their source repository.
Useful Things to Ask About
The Assistant can answer questions about skills discovered from your connected repositories. For example:
- "What skills are available for Helm chart scaffolding?"
- "Show me skills related to mkdocs navigation."
Permissions
Skill catalog access follows the same pattern as repository content:
| Role | Permissions |
|---|---|
| Admin, Editor, Contributor, Viewer, Demo | Read (list and detail) |
Skills are created, updated, and removed automatically by the ingestion pipeline. There is no manual registration or deletion in the dashboard.
Troubleshooting
| Situation | What to do |
|---|---|
Skill not appearing after commit | Wait for the next repository content ingestion run. Confirm the repository is connected, ingestion is enabled, and the file is named |
Skill disappeared from the catalog | The |
Invalid skill name error | The |
Missing trigger summary | Add a "Use when..." phrase to the |
Cannot access the Skills page | Your role may not include Skill read permission. Contact your Venue administrator. |
See Also
- MCP Servers - Register and inspect MCP servers in your organization.
- Venue MCP Endpoint - Connect external AI tools to query Venue.sh data.
- Assistant - Using the Assistant in the Venue.sh portal.
- Importing Repositories - Connect Git repositories for catalog ingestion.
- AI Settings - Enable repository indexing and AI usage.