Google Cloud opens its skill registry and gives teams a choice about blocking risky revisions

Decide what happens when a scan finds a problem

Google Cloud made standalone skills generally available in Agent Registry on November 6. A skill packages instructions and may include scripts or other files that an agent uses to carry out a task. The registry gives teams a way to identify which version an agent is meant to use and to review findings for a specific upload.

Google says the default blocking policy prevents downloads of revisions with findings. It also prevents a pending or flagged revision from becoming the default. Teams can choose an audit mode that reports findings without the same block, or turn scanning off. Organization administrators can require blocking mode through policy.

Check old uploads before relying on the gate

Changing the policy applies to future revisions. Google’s guide says existing uploads are not rescanned automatically. CGH’s assessment is that teams moving existing skills into a governed workflow should check the status of the revision actually in use. The scanner uses a model to analyze the package and can miss issues or flag benign material. A completed scan is one signal for review.

Budget separately for scanning

Google lists no charge for registry storage, search or API operations. Scanning is free through December 31, 2026, with a published rate of US$8 per million input tokens beginning January 1, 2027. The locations guide lists global, U.S. and European multi-regions and supported individual regions. Google labels customer-managed encryption keys for skill payloads as a preview. CGH reviewed the documentation without uploading or testing a skill.