How Nacos 3.2 Brings AI Registry and Secure Skill Management to OpenClaw

OpenClaw’s ClawHub market now hosts over 10,000 Skills, but many are malicious; a Skill can execute arbitrary commands once loaded, exposing the Agent’s full permissions. To prevent such security breaches, enterprises must adopt a private Skills Registry that adds pre‑publish scanning, signature verification, sandbox isolation and least‑privilege enforcement.

Nacos 3.2 (Beta) launches the AI Registry, which unifies four resource types—MCP, Agent, Prompt and Skill—under a single console. The release adds:

AI Registry : unified registration, search, versioning and namespace isolation for AI assets.

Prompt Registry : create Prompt templates with {{variable}} placeholders, edit, version and manage them like configuration items.

Skill Registry : register, upload (ZIP), list, paginate, download and isolate Skills per namespace, with full lifecycle management.

Nacos Copilot : integrates large‑model capabilities via agentscope‑java, offering structured Prompt and Skill optimization directly in the console.

Installation is handled by nacos-setup, a one‑click script supporting macOS, Linux and Windows, single‑node or cluster modes. Example commands:

curl -fsSL https://nacos.io/nacos-installer.sh | sudo bash

Then start the beta version: sudo nacos-setup -v 3.2.0-BETA After the server starts, the default login is nacos with an auto‑generated password copied to the clipboard.

Using the AI Registry :

In the console, create Prompt templates, set variables, publish new versions, and view history.

In the Skill page, register or upload Skills, search by name, paginate results, and manage namespaces.

Nacos‑cli provides command‑line access to configuration, Prompt and Skill operations, enabling scripting and CI/CD integration. Example commands:

nacos-cli -p <password> skill-list</code><code>nacos-cli skill-get my-skill</code><code>nacos-cli skill-upload /path/to/skill</code><code>nacos-cli skill-sync my-skill

To enable Copilot, set the LLM API key either in the console Settings or via the environment variable COPILOT_API_KEY, then restart Nacos.

AI Coding Agent Integration :

Skills from the nacos-skill-registry can be installed in AI coding tools (e.g., Qoder, Cursor, Claude Code) so that the agents can search, install and publish Skills directly from Nacos, facilitating team‑wide sharing.

For Cursor, install nacos-cli, sync the built‑in nacos-skill to the local Skill directory with skill-sync, and then use natural language commands such as “List available Skills on Nacos” or “Install the code‑review Skill”.

Integration with agentscope‑java :

Add the following Maven dependencies (compatible with Nacos 3.2.0‑BETA):

<dependency>
  <groupId>com.alibaba.nacos</groupId>
  <artifactId>nacos-client</artifactId>
  <version>3.2.0-BETA</version>
</dependency>
<dependency>
  <groupId>io.agentscope</groupId>
  <artifactId>agentscope-core</artifactId>
  <version>1.0.10</version>
</dependency>
<dependency>
  <groupId>io.agentscope</groupId>
  <artifactId>agentscope-extensions-nacos-prompt</artifactId>
  <version>1.0.10</version>
</dependency>
<dependency>
  <groupId>io.agentscope</groupId>
  <artifactId>agentscope-extensions-nacos-skill</artifactId>
  <version>1.0.10</version>
</dependency>

Create an AiService with the Nacos address and optional namespace:

Properties props = new Properties();
props.put(PropertyKeyConst.SERVER_ADDR, "127.0.0.1:8848");
props.put(PropertyKeyConst.NAMESPACE, "public");
AiService aiService = AiFactory.createAiService(props);

Use NacosPromptListener to fetch rendered Prompts and build an ReActAgent. For Skills, either sync them locally with nacos-cli skill-sync and load via FileSystemSkillRepository, or fetch them at runtime with NacosSkillRepository.

Future Plans include making Nacos the backend registry for npx skills, adding full API compatibility, and extending security features such as fine‑grained data permissions, skill signing and approval workflows.

Overall, Nacos 3.2 transforms Nacos from a pure configuration and service‑discovery system into a comprehensive AI infrastructure platform, providing secure, versioned, and observable management of Prompts, Skills, MCPs and Agents.