Get started with Skills in AI Registry. Console operations require no network configuration — sign in through a browser to complete the entire flow from creation to publishing.
Overview
AI Registry, also known as AI Governance Center, is an AI resource management platform provided by Alibaba Cloud MSE. Skill is one of its core resource types. A Skill is a reusable capability unit for AI agents, consisting of a SKILL.md description file and optional resource files. Through AI Registry, you can centrally manage Skill versions, publishing, and distribution.
A Skill version moves through the following lifecycle: Draft (editable) → Pending (review approved) → Released (serves externally, content cannot be changed).
Prerequisites
| Prerequisite | Description |
| Alibaba Cloud account | You have an Alibaba Cloud account and have activated the AI Registry service. |
| RAM permissions | Your account has permissions for Skill operations. To grant permissions to a RAM user, see Configure RAM Permissions for AI Registry. |
| AI Security Guardrail | To run the content security scan in Step 3: Submit for review and publish, first activate Alibaba Cloud AI Security Guardrail. For instructions, see the note in that step. |
| AccessKey pair | Client access in Step 4: Use the Skill requires the AccessKey ID and AccessKey secret of your Alibaba Cloud account or a RAM user. |
| Workspace namespace ID | Client access in Step 4: Use the Skill requires the namespace ID of the workspace that you create in Step 1: Create a workspace. You can view it on the Workspace page in the console. |
| VPC resources | Required only for VPC private network access in Step 4: Use the Skill: a VPC in the target region, a vSwitch, and a security group. For details, see Configure VPC private network access. |
Step 1: Create a workspace
A workspace is the resource isolation container in AI Registry. Use it to divide AI asset boundaries by environment or team.
Log on to the MSE console. In the left-side navigation pane, choose AI Registry to enter the AI Registry console.
In the left-side navigation pane, choose Workspace, and then click Create Workspace.
Set the following parameters, and then click Create:
Parameter Required Description Name Yes Up to 64 characters. Description No Up to 512 characters. Tag No Press Enter to confirm each tag. Tags are used for business categorization and search. Scan Policy - Risk Block Level No Low, Medium, or High. Default value: Medium. Scan Policy - Skip Tolerance No A percentage from 0 to 100. Default value: 80. After the workspace is created, it appears in the workspace list.
Step 2: Create or import a Skill
To start from scratch, follow Create a Skill. If you already have a local Skill directory, follow Import an existing Skill instead.
Create a Skill
In the left-side navigation pane, choose . In the workspace drop-down list at the top of the page, select the target workspace.
In the upper-right corner, click + New Skill.
Set the basic information:
Parameter Required Description Skill Name Yes Up to 64 characters. Only letters, digits, underscores (_), and hyphens (-) are supported. Description Yes Up to 1,000 characters. Describes the functionality and purpose of the Skill. Tag No Press Enter to confirm each tag. Tags are used for business categorization and search. Expand Advanced Options to set the visibility: Private (default, visible only to you) or Public (visible to everyone).
In the editor, write the
SKILL.mdfile (required). TheSKILL.mdfile uses Markdown format, with editing on the left and a real-time preview on the right. The basic structure is as follows:name(required): the Skill name, used for identification.description(required): a purpose description that explains the functionality and applicable scenarios of the Skill.instructions(required): the core instructions that define how an agent uses the Skill.Optional fields:
tools(tool list),dependencies(dependencies), and more.After you finish editing, click Create Now in the upper-right corner. The system generates a draft version of the Skill in the Draft state, and the Skill appears on the Skill list page.
Import an existing Skill
In the left-side navigation pane, choose . On the Skill list page, click Import Skill. Two import methods are supported:
Import Preset Skill: The system provides built-in official preset Skill templates. Select the Skills that you need and import them with one click.
Upload File: Package your local Skill directory into a ZIP file and upload it.
After the import, the system automatically generates a draft version.
Step 3: Submit for review and publish
On the Skill list page, go to the details page of the target Skill and confirm that the SKILL.md content is correct.
Click Submit for Review. The system automatically runs a content security scan, including prompt injection detection and compliance checks.
ImportantTo run a security scan on Skill content, first activate Alibaba Cloud AI Security Guardrail. For instructions, see Activate AI Security Guardrail pay-as-you-go.
After the review passes, the version enters the Pending state. Click Publish Version.
After the version is published, confirm in the information area on the right that Enable is turned on.
If the review fails, view the review result and the failure reason on the Skill details page, modify the SKILL.md content as prompted, and then click Submit for Review again.
Step 4: Use the Skill
You can integrate a published Skill through three methods: Nacos CLI, Java SDK, and AgentScope. Before you run the client, select an access method based on your deployment location:
Public network access — Suitable for local development, an IDC, or applications that are not deployed in an Alibaba Cloud VPC. First add a public endpoint as described in Configure public network access for AI Registry, and add the public egress IP address of the caller to the IP address whitelist. After you complete the configuration, verify connectivity by running a
pingagainst the public endpoint domain name from your client device.VPC private network access — Suitable for applications deployed in an Alibaba Cloud VPC. Configure VPC private network access as described in Configure VPC private network access, and then run the client on an ECS instance in the associated VPC.
Choose an integration method
| Integration method | Scenario | Tech stack requirement |
| Nacos CLI (recommended) | Command-line operations and script integration | Node.js environment |
| Java SDK | Java application integration | JDK 1.8+, Maven project |
| AgentScope | AI applications that use the AgentScope framework | JDK 17+, Maven project |
Configure VPC private network access
If you select public network access, skip this section and use the endpoint domain name from the public network access configuration guide as the host/serverAddr value.
If you select VPC private network access, associate a VPC with one click in Provisioning in the AI Registry console. The system automatically completes the PrivateLink endpoint configuration. You do not need to create an endpoint manually in the VPC console. For more configuration details, see the dedicated VPC private network access topic in See also.
The following prerequisites apply. If any resource is missing, create it first:
A VPC is created in the target region. For more information, see Create or delete VPCs and vSwitches.
A VPC and a vSwitch for deploying your application are created. If they are not created, see Create VPC and vSwitch.
A security group is created. If it is not created, see Security groups.
Procedure:
Log on to the MSE console. In the left-side navigation pane, choose .
In the VPC Access section, click + Associate VPC in the upper-right corner.
In the dialog box, set the following parameters:
Parameter Description Select VPC Select the target VPC that you created. Zone and vSwitch Select a zone in the VPC and the corresponding vSwitch. Click + Add vSwitch to configure multiple vSwitches. Select at least two zones for high availability. Security Group Select a security group that allows access from within the VPC. Description Optional. Helps you identify this access record. Click Confirm Association. The system automatically creates the VPC endpoint, which typically takes effect within 1 to 2 minutes. When the status changes to
Available, the access configuration is complete.
Verify connectivity:
After the access configuration is complete, the private access domain name of the current region appears at the top of the VPC Access section. If the VPC already contains an ECS instance, run the following command on the ECS instance to verify connectivity:
# Test network connectivity (Hangzhou region as an example)
ping -c 4 airegistry.cn-hangzhou.mse.aliyuncs.comMethod A: Nacos CLI
Configure credentials: On the device that runs the client, run the following command to configure the logon credentials:
npx @nacos-group/cli profile editProvide the following information as prompted:
| Parameter | Description | Example |
host | The access address of AI Registry. For public network access, enter the public endpoint domain name. For VPC private network access, enter the private access domain name. | Private: airegistry.cn-hangzhou.mse.aliyuncs.com Public: xxxx.airegistry.cn-hangzhou.mse.aliyuncs.com |
port | The access port. | 80 |
authType | The authentication method. Fixed to aliyun. | aliyun |
accessKey | Alibaba Cloud AccessKey ID. | <AccessKey ID> |
secretKey | Alibaba Cloud AccessKey secret. | XXXXXXXXXXXXXXXXXXXXxx |
namespace | The namespace ID of the workspace. You can view it on the Workspace page in the console. | xxxxxx-xxxx-xxxx-xxxx-xxxxxx |
Verify the connection:
npx @nacos-group/cli skill-listThe configuration is successful if the command returns a Skill list. The list can be empty.
Download a Skill: Multiple AI coding tools are supported, including QwenPaw, Qoder, Claude, Codex, and Cursor. On the Skill details page in the console, select the corresponding tool. The page automatically generates the command. Copy the command and run it:
# Download the latest version
npx @nacos-group/cli skill-get <skill-name>
# Download a specific version
npx @nacos-group/cli skill-get <skill-name> --version 1.0.0 -o ~/my-skills
# Download by label
npx @nacos-group/cli skill-get <skill-name> --label latestMethod B: Java SDK
Add the dependency: For the nacos-client version that supports Skills, see Access AI Registry with the Nacos Java SDK.
<dependency>
<groupId>com.alibaba.nacos</groupId>
<artifactId>nacos-client</artifactId>
<version>${nacos.version}</version>
</dependency>Initialize AiService:
Replace SERVER_ADDR with the public endpoint domain name or the private domain name.
Properties properties = new Properties();
properties.setProperty(PropertyKeyConst.SERVER_ADDR, "airegistry.cn-hangzhou.mse.aliyuncs.com:80");
properties.setProperty(PropertyKeyConst.NAMESPACE, "xxxxxx-xxxx-xxxx-xxxx-xxxxxx");
properties.setProperty(PropertyKeyConst.ACCESS_KEY, "your-access-key-id");
properties.setProperty(PropertyKeyConst.SECRET_KEY, "XXXXXXXXXXXXXXXXXXXXxx");
AiService aiService = AiFactory.createAiService(properties);One AiService instance corresponds to one namespace. To access multiple namespaces, create a separate instance for each namespace. Reuse the same instance within an application whenever possible, and call shutdown() to release resources on exit.
Download a Skill ZIP file:
The SDK provides three download methods: by name, by version, and by label. Each method returns a ZIP byte array (byte[]) that contains SKILL.md and all resource files. Binary resources are automatically decoded from Base64.
try {
// Download the latest version
byte[] skillZip = aiService.downloadSkillZip("my-first-skill");
// Download a specific version
byte[] skillZipByVer = aiService.downloadSkillZipByVersion("my-first-skill", "1.0.0");
// Download by label
byte[] skillZipByLabel = aiService.downloadSkillZipByLabel("my-first-skill", "latest");
} catch (NacosException e) {
e.printStackTrace();
}Subscribe to Skill changes:
Use subscribeSkill to subscribe to Skill updates. When the ZIP content changes, the listener callback is triggered. version and label are optional and narrow the subscription scope:
try {
aiService.subscribeSkill("my-first-skill", null, null, new AbstractNacosSkillListener() {
@Override
public void onEvent(SkillEvent event) {
byte[] newZip = event.getSkillZip();
System.out.println("skill updated, size: " + newZip.length);
}
});
} catch (NacosException e) {
e.printStackTrace();
}Method C: AgentScope
Use the agentscope-extensions-nacos-skill module to use AI Registry Skills in the AgentScope framework.
Add the dependency: For the dependency version, see Integrate AgentScope with Nacos AI Registry to Use Skills.
<dependency>
<groupId>io.agentscope</groupId>
<artifactId>agentscope-extensions-nacos-skill</artifactId>
</dependency>Complete example (copy and run):
Before you run the example, set the DASHSCOPE_API_KEY environment variable to the API key of your model service. Replace SERVER_ADDR with the public endpoint domain name or the private domain name.
import com.alibaba.nacos.api.PropertyKeyConst;
import com.alibaba.nacos.api.ai.AiFactory;
import com.alibaba.nacos.api.ai.AiService;
import io.agentscope.core.ReActAgent;
import io.agentscope.core.model.DashScopeChatModel;
import io.agentscope.core.message.Msg;
import io.agentscope.core.nacos.skill.NacosSkillRepository;
import io.agentscope.core.skill.AgentSkill;
import io.agentscope.core.skill.SkillBox;
import java.util.Properties;
public class QuickStart {
public static void main(String[] args) throws Exception {
// 1. Connect to AI Registry
Properties props = new Properties();
props.put(PropertyKeyConst.SERVER_ADDR, "airegistry.cn-hangzhou.mse.aliyuncs.com:80");
props.put(PropertyKeyConst.NAMESPACE, "xxxxxx-xxxx-xxxx-xxxx-xxxxxx");
props.put(PropertyKeyConst.ACCESS_KEY, "your-access-key");
props.put(PropertyKeyConst.SECRET_KEY, "your-secret-key");
AiService aiService = AiFactory.createAiService(props);
// 2. Load Skill
NacosSkillRepository repo = new NacosSkillRepository(aiService, "public");
AgentSkill skill = repo.getSkill("my-first-skill");
// 3. Bind to Agent
SkillBox skillBox = new SkillBox(repo);
ReActAgent agent = ReActAgent.builder()
.name("MyAgent")
.model(DashScopeChatModel.builder()
.apiKey(System.getenv("DASHSCOPE_API_KEY"))
.modelName("qwen-max")
.build())
.skillBox(skillBox)
.build();
// 4. Chat
Msg response = agent.call(Msg.of("Hello"));
System.out.println(response.getText());
aiService.shutdown();
}
}You can filter a specific version by version (AGENTSCOPE_NACOS_SKILL_VERSION) or by label (AGENTSCOPE_NACOS_SKILL_LABEL). The repository is read-only.
For more configuration options and advanced usage, see Integrate AgentScope with Nacos AI Registry to Use Skills.
What's next: Manage the Skill lifecycle
After you publish a Skill, you can also perform the following operations in the console. For detailed instructions, see the Skill management topic in See also.
Modify Visibility: Set the Skill to Public or Private. A private Skill is visible only to its owner.
Enable/Disable: Control whether the Skill serves externally as a whole. After you disable it, all versions stop serving immediately.
Version Iteration: Create a new draft from a published version, edit it, submit it for review, and publish it. Update labels to point to the new version.
Online/Offline: Control whether a single published version is externally available.
Edit Business Tags: Add custom tags to the Skill for categorization and search.
Emergency takedown: If you find an issue with a Skill and must stop it immediately, disable the entire Skill, which affects all versions, or take only the problematic version offline. Deleting a Skill is irreversible. Disable the Skill and observe it for a period of time before you delete it.
FAQ
Q: The target VPC does not appear in the Associate VPC list.
Confirm that the logged-on account has VPC read permissions in the region of the target VPC, and that the VPC and the AI Registry instance are in the same region.
Q: After the VPC is associated, ping to the private domain name from an ECS instance fails.
Check the following items in sequence:
The status of the VPC in is
Available.The ECS instance resides in the associated VPC and zone.
The security group rules allow the corresponding traffic.
You use the private domain name of the corresponding region.
Q: The CLI skill-list command returns an authentication failure.
Check whether the AccessKey and SecretKey are correct, and whether the RAM user is granted the relevant permissions.
Q: The CLI skill-release command returns HTTP 400 parameter validate error.
The review is asynchronous. If you run skill-release immediately after skill-review, the command fails because the version state has not changed to reviewed. Wait a few seconds, use skill-describe to confirm the version state, and then retry. For the full Nacos CLI command reference, see See also.
Q: How do I obtain Skill resource files by using the Java SDK?
downloadSkillZip returns a ZIP byte stream that contains SKILL.md and all resource files. Decompress the ZIP file to use the files. For the three download methods, see Method B: Java SDK.
See also
AI Registry Workspace Management Guide: Create, query, and edit workspaces.
AI Registry Skill Management Guide: Skill version management, publishing, and download.
AI Registry VPC PrivateLink Configurations: Steps to configure VPC private network access.
AI Governance Center Prompt Management Guide: Prompt creation, version management, debugging, and optimization.
Configure public network access for AI Registry: Steps to configure a public endpoint and the IP address whitelist.
Connect Nacos CLI to AI Registry: Access AI Registry through the Nacos CLI.
Access AI Registry with the Nacos Java SDK: Nacos Java SDK access configuration and capability overview.
Integrate AgentScope with Nacos AI Registry to Use Skills: Reference AI Registry Skills in the AgentScope framework.