skills.rest
jfrog
jfrogOFFICIAL
Explore all skills by this author →
WebsiteGitHub

jfrog-package-curation

Check package safety and download artifacts through JFrog Artifactory curation policies.

1|Updated Aug 3, 2026
Search Tags:#curation#npm#dependency management#root cause analysis#package security#jfrog#artifactory
One-click install
npx skills add https://github.com/jfrog/jetbrains-plugin --skill jfrog-package-curation-jfrog
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: jfrog-package-curation
Source: https://github.com/jfrog/jetbrains-plugin/tree/main/.junie/skills/jfrog-package-curation
Command: npx skills add https://github.com/jfrog/jetbrains-plugin --skill jfrog-package-curation-jfrog

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? When a package install fails with errors like ETARGET, 403, or "blocked by curation policy", or when you need to verify whether an npm, Maven, PyPI, or Go package is safe and allowed before downloading, this Skill diagnoses the root cause and downloads the package through JFrog Artifactory. ## Core Features & Use Cases - Package Safety Check: Queries the JFrog Public Catalog and Stored Packages via OneModel GraphQL to find a package, determine its latest version, and interpret catalog security signals. - Curation-Aware Download: Checks curation entitlement and policy status via the Xray curation API, then downloads allowed artifacts through local, federated, or remote repositories using jf rt dl. - Failure Root-Cause Analysis: Investigates curation-attributable failures (ETARGET, 403, missing versions, waivers not applied) using the JFrog MCP curation audit tools and a two-gate resolution/download model. - Use Case: A developer runs npm install lodash@4.18.1 and gets ETARGET. The Skill checks the public catalog for version existence, queries the CVS audit to find the blocking policy, and reports which compliant version to use instead. ## Quick Start Check whether the npm package lodash version 4.17.21 is allowed by curation and download it through Artifactory.

Frequently Asked Questions about jfrog-package-curation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check if a package is blocked by JFrog Curation?▼

Query the Xray curation API endpoint /xray/api/v1/curation/package_status/all_repos with the package type, name, and version via the jf CLI. An exit code of 0 means allowed, while a 403 on stderr means blocked by a curation policy with the reason in the response body.

How to download a package through Artifactory remote repository?▼

Use jf rt dl against the base remote repository name, stripping any -cache suffix, with a full target file path and the --flat flag. Targeting the base remote repo transparently triggers the remote fetch and caches the artifact if it is not yet cached.

Why does npm install fail with ETARGET on a curated registry?▼

ETARGET means the pinned version is newer than the version Curation approved, so it was filtered from the curated version list and the client cannot resolve it. Check the public catalog for version existence and the CVS audit events to find which policy blocked it and which version was selected.

Does the curation troubleshooting workflow work without the JFrog MCP server?▼

No, the failure troubleshooting path requires the JFrog MCP curation tools (jfs_curation_*) and has no jf CLI equivalent. The check-and-download path works with only the JFrog CLI, but root-cause analysis needs Xray 3.153.0 or later with Curation entitled.

What package types does JFrog Curation support?▼

The curation package status API supports npm, pypi, maven, go, nuget, docker, and gradle as lowercase package type values. Other values return an error, and the public catalog covers only a subset of types for version existence checks.

When should I not use this package curation workflow?▼

Do not use it for pure CVE or vulnerability lookups, which are handled by the JFrog platform skill's security domain queries. Also do not use it for installing or managing MCP servers, even when they are named like packages.

Related Skills

Explore More Software Engineering Skills→
jfrogjfrog
5

jfrog-onemodel

Query JFrog Platform data via OneModel GraphQL with schema validation.

Official
Advanced
theslashdojotheslashdojo

npm-install

Install and manage Node.js package dependencies and lockfiles for reproducible builds.

Official
Intermediate
Fantasia1999Fantasia1999

senior-secops

Execute SAST/DAST scans and generate CVE remediation plans.

Community
Advanced
jfrogjfrog
19

jfrog-package-safety-and-download

Check package safety and download packages from JFrog Platform via catalogs and remote repositories.

Official
Advanced