jfrog-package-curation

Discover, search, install, update, remove, and publish agent skills and plugins hosted in the JFrog AI Catalog (Artifactory) via the JFrog CLI (`jf skills`, `jf agent plugins`) and JFrog Agent Guard. Use whenever the user asks what skills or plugins are available or installed, wants to browse/search the catalog, see versions, install/update/uninstall/delete a skill or plugin, publish/upload/release one to JFrog / Artifactory / the AI Catalog, or list the AI Catalog (skill/plugin governance) policies — allow-lists, malicious-skill checks — that apply to skills in a project. Do NOT use this skill for MCP servers (that's jfrog-mcp-management, even when the user says "policy" or "approved"), for Xray or curation "blocked by policy" package errors (that's jfrog-package-curation), or for Xray policies and watches (that's the base jfrog skill).

Set up and verify the JFrog plugin. Run on first install, to complete initial configuration, or to diagnose a broken setup.

Use to install, list, or remove MCP servers, and to discover which MCPs the user can install — including questions about available, approved, or allowed MCPs for a project. That governed catalog is the authoritative answer; do not answer those questions from local IDE/settings allowlists alone. Use whenever the user wants to add/enable/install/list/remove/uninstall/configure an MCP or write/update the agent's MCP config — even if they name a package like `@scope/pkg` and even without saying "MCP" or "JFrog". Never install an MCP any other way. All of this goes through the JFrog Agent Guard (npx @jfrog/agent-guard).

Guides JFrog Platform topology, sizing (RPM, t-shirt templates), deployment, multi-site use cases, SaaS vs self-managed, HA, air-gapped, and disaster recovery using the official Reference Architecture site as the sole source of facts. Use this skill when the user asks how to size Artifactory or Xray, which deployment pattern to choose, single vs multi site, active-active, active-passive, CI/CD separation, Helm/Kubernetes install planning, or reference architecture (live WebFetch from jfrog.com/reference-architecture). Do NOT use for artifact search or download, repository or permission admin, CVE or vulnerability lookups, live jf CLI operations against their instance, or package curation — use the jfrog base skill or jfrog-package-curation instead.

Use this skill when the user asks to set up, configure, bind, or connect a package manager (npm, pip, uv, pipenv, maven, gradle, go, docker, helm, ...) to JFrog Artifactory via `jf setup` and `.jfrog/local/package-resolution.json`; when a workspace manifest exists with no matching binding entry; or when a session hook reports package-manager config missing. Skip when the binding already has the same repo key. When the session status is `already set up` or `setting up in the background`, do not invoke this skill proactively for a missing workspace binding. An explicit setup or rebind request, and a JFrog 401/403, still invoke it. Never pick a repo by discovery; use resolver output only (unless the user names or asks to browse repos, or a global key is BLOCKED). On unresolved or failed setup, ask with the failure verbatim — never switch servers. NOT for installing packages, general Artifactory repo operations (use the base jfrog skill), or MCP server setup (use jfrog-mcp-management).

Interact with the JFrog Platform via the JFrog CLI, JFrog MCP server and REST/GraphQL APIs. Use this skill when the user wants to manage Artifactory repositories, upload or download artifacts, manage builds, configure permissions, manage users and groups, work with access tokens, configure JFrog CLI servers, search artifacts, manage properties, set up replication, manage JFrog Projects, run security audits or scans, look up CVE details, query exposures scan results from JFrog Advanced Security, manage release bundles and lifecycle operations, aggregate or export platform data, or perform any JFrog Platform administration task. Also use when the user mentions jf, jfrog, artifactory, xray, distribution, evidence, apptrust, onemodel, graphql, workers, mission control, curation, advanced security, exposures, sast, or any JFrog product name. Do NOT use this skill to install, add, remove, list, or manage MCP servers.

Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized `repro_outputs/` files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.

When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.

Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.

Audit, diagnose, or optimize website loading and interaction performance, Core Web Vitals, and Lighthouse performance scores.

Audit a landing page, sales page or checkout page for conversion leaks and return a fix list ordered by expected revenue impact. Use when asked to review, critique or improve a landing page, sales page, opt-in page, product page or checkout flow, when conversion rate is low, when paid traffic is not converting, or when someone asks "why isn't this page converting" or wants a CRO / landing page review.

Audit a browser fingerprint for internal contradictions with the liarjs CLI - canvas, WebGL, WebGL2, WebGPU, audio, 220 fonts, WebRTC and timezone probes, scored against the TLS/HTTP/ASN view of the same request. Use when asked to run a browser fingerprint test, see what a fingerprint looks like, check canvas or WebGL fingerprint stability, compare a spoofed profile against a real browser, or find out whether a browser profile is self-consistent.

Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.

When the user wants help with pricing decisions, packaging, or monetization strategy. Also use when the user mentions 'pricing,' 'pricing tiers,' 'freemium,' 'free trial,' 'packaging,' 'price increase,' 'value metric,' 'Van Westendorp,' 'willingness to pay,' 'monetization,' 'how much should I charge,' 'my pricing is wrong,' 'pricing page,' 'annual vs monthly,' 'per seat pricing,' 'should I offer a free plan,' 'pricing page teardown,' 'pricing page audit,' 'is my pricing page AI-readable,' or 'can AI read my pricing.' Use this whenever someone is figuring out what to charge, how to structure their plans, or wants to audit a pricing page (for humans and for the AI agents that shortlist tools). For in-app upgrade screens, see paywalls. For offer construction (bonuses, guarantees, value framing, naming) on services/courses/coaching/high-ticket B2B, see offers.