[patch] chore: sync skills to v0.31.1

.devin-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "jfrog",
   "displayName": "JFrog Platform",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Official JFrog plugin for Devin. Ships the JFrog skills bundle (platform ops, init, MCP management, AI Catalog, package safety, reference architecture, package-manager setup) and registers the JFrog Platform MCP server (remote HTTP + OAuth).",
   "author": {
     "name": "JFrog Ltd.",

.github/scripts/sync-skills-vendor.json

@@ -1,6 +1,6 @@
 {
   "repo": "jfrog/jfrog-skills",
-  "pin": "v0.30.0",
+  "pin": "v0.31.1",
   "paths": [
     "skills"
   ]

README.md

@@ -2,7 +2,7 @@
 
 JFrog plugin for [Devin](https://devin.ai/): JFrog Platform skills for artifact management, security scanning, and supply-chain workflows, plus the JFrog Platform MCP server (remote HTTP + OAuth).
 
-> **Current version:** `0.3.0` — skills from [jfrog/jfrog-skills](https://github.com/jfrog/jfrog-skills) (pinned at `v0.25.0`) and a bundled JFrog MCP entry.
+> **Current version:** `0.3.0` — skills from [jfrog/jfrog-skills](https://github.com/jfrog/jfrog-skills) (pinned at `v0.31.1`) and a bundled JFrog MCP entry.
 
 ## Skills
 
@@ -11,10 +11,10 @@ JFrog plugin for [Devin](https://devin.ai/): JFrog Platform skills for artifact
 | `jfrog` | JFrog Platform operations via CLI and APIs (Artifactory, Xray, access, projects, and more). |
 | `jfrog-init` | Plugin readiness / setup (detect CLI, config, MCP, and related bootstrap steps). |
 | `jfrog-mcp-management` | Install, list, and remove MCP servers through JFrog Agent Guard; browse the JFrog MCP catalog. |
-| `jfrog-ai-catalog-skills` | Discover, install, manage, and publish agent skills from the JFrog AI Catalog via `jf skills` and Agent Guard. |
+| `jfrog-ai-catalog` | Discover, install, manage, and publish agent skills from the JFrog AI Catalog via `jf skills` and Agent Guard. |
 | `jfrog-setup-package-managers` | Bind package managers (npm, pip, Maven, Go, and more) to JFrog Artifactory via `jf setup`. |
 | `jfrog-reference-architecture` | JFrog Platform topology, sizing, deployment patterns, and multi-site guidance. |
-| `jfrog-package-safety-and-download` | Check package safety and download via Artifactory. |
+| `jfrog-package-curation` | Check package safety and download via Artifactory. |
 
 After install, Devin exposes them as `/jfrog:<skill-name>` (for example `/jfrog:jfrog-mcp-management`).
 
@@ -44,7 +44,7 @@ The plugin registers this MCP server (declared in `mcp.json` and referenced from
 - **Devin CLI** — see [Devin docs](https://docs.devin.ai/)
 - **Devin CLI plugins enabled** for your organization (`devin plugins install` must be allowed)
 - **`JFROG_PLATFORM_URL`** — JFrog platform host only (no `https://`, no trailing `/`). Required for the bundled MCP entry.
-- **Skill runtime** (when using the skills) — `jf` CLI, `jq`, and `curl` on `PATH`, plus a configured JFrog instance (`jf config add`). See [jfrog-skills requirements](https://github.com/jfrog/jfrog-skills/blob/v0.25.0/README.md#requirements).
+- **Skill runtime** (when using the skills) — `jf` CLI, `jq`, and `curl` on `PATH`, plus a configured JFrog instance (`jf config add`). See [jfrog-skills requirements](https://github.com/jfrog/jfrog-skills/blob/v0.31.1/README.md#requirements).
 
 ## Installation
 
@@ -79,10 +79,10 @@ devin-plugin/
 │   ├── jfrog/
 │   ├── jfrog-init/
 │   ├── jfrog-mcp-management/
-│   ├── jfrog-ai-catalog-skills/
+│   ├── jfrog-ai-catalog/
 │   ├── jfrog-setup-package-managers/
 │   ├── jfrog-reference-architecture/
-│   └── jfrog-package-safety-and-download/
+│   └── jfrog-package-curation/
 ├── .github/scripts/          # sync-skills vendoring
 ├── LICENSE
 ├── README.md

VENDOR.md

@@ -7,7 +7,7 @@ The skill packages under `skills/` are vendored from **[jfrog/jfrog-skills](http
 | **Repository** | https://github.com/jfrog/jfrog-skills |
 | **Pinned release** | see `pin` in [`.github/scripts/sync-skills-vendor.json`](.github/scripts/sync-skills-vendor.json) |
 
-Included directories (as of the pinned release): `jfrog/`, `jfrog-init/`, `jfrog-ai-catalog-skills/`, `jfrog-mcp-management/`, `jfrog-package-safety-and-download/`, `jfrog-reference-architecture/`, `jfrog-setup-package-managers/`.
+Included directories (as of the pinned release): `jfrog/`, `jfrog-init/`, `jfrog-ai-catalog/`, `jfrog-mcp-management/`, `jfrog-package-curation/`, `jfrog-reference-architecture/`, `jfrog-setup-package-managers/`.
 
 ## Refreshing
 

skills/jfrog-package-safety-and-download/SKILL.md → skills/jfrog-package-curation/SKILL.md

@@ -1,25 +1,61 @@
 ---
-name: jfrog-package-safety-and-download
+name: jfrog-package-curation
 description: >-
-  Check JFrog Public Catalog and stored packages for a version, interpret
-  catalog security signals, and download through Artifactory (JFrog Platform
-  locations, remote cache, curation-aware package managers, or repo proxy).
-  Use when the user asks whether a package is safe, allowed, curated, or
-  wants to download npm, Maven, PyPI, Go, or similar packages via JFrog.
-  Do NOT use for pure CVE or vulnerability lookups (e.g. "details on
-  CVE-2021-23337") — those are handled by the jfrog skill's Public security
-  domain queries without this workflow.
+  Check/download a package (npm, Maven, PyPI, Go...) via JFrog — safe,
+  allowed, curated? Or: package op fails/blocked (ETARGET, 403, blocked by
+  curation policy, missing version, waiver) — root cause it. Checks the JFrog Public
+  Catalog and stored packages for a version, interprets catalog security
+  signals, and downloads through Artifactory (JFrog Platform locations,
+  remote cache, curation-aware package managers, or repo proxy). Do NOT use
+  for pure CVE or vulnerability lookups (e.g. "details on CVE-2021-23337")
+  — those are handled by the jfrog skill's Public security domain queries
+  without this workflow. Do NOT use for installing, listing, or approving MCP
+  servers/tools (even when named like a package, e.g. `@scope/pkg`) — that's
+  `jfrog-mcp-management`.
+compatibility: >-
+  "Check & download" needs only the JFrog CLI (`jf`). "Troubleshoot a
+  failure" needs the JFrog MCP curation tools (`jfs_curation_*`) — `jf` CLI
+  alone does not cover it; if unavailable, that section cannot run (see its
+  Preflight). Its reference file is local; outbound HTTPS is optional there
+  too (on-demand WebFetch of JFrog docs) — without it, it runs on the MCP
+  tools and local reference, degraded.
 metadata:
   role: workflow
 ---
 
-# JFrog Package Safety and Download
+# JFrog Package Curation
 
 ## Prerequisites
 
 - Read `../jfrog/SKILL.md` for JFrog Platform concepts, domain model, CLI setup, and API patterns.
 - **OneModel shapes drift by server version.** Before inventing GraphQL fields or `where` filters, read `../jfrog/references/onemodel-graphql.md` (schema fetch workflow) and `../jfrog/references/onemodel-query-examples.md` (**Public packages**, **Stored packages**). Regenerate or verify queries against `GET "$JFROG_URL/onemodel/api/v1/supergraph/schema"` when examples fail validation.
 
+## Which path do I need?
+
+- **Package hasn't been checked or downloaded yet** (is it safe / allowed / curated? download it) → go to **Check & download** below.
+- **A package operation already failed** — `ETARGET` (npm), "no matching distribution" (pip), `NU1102` (NuGet), a version missing/stripped from the registry, `403` / "blocked by curation policy", or an approved waiver not taking effect → go to **Troubleshoot a failure** below.
+
+---
+
+# Troubleshoot a failure
+
+> **Requires the JFrog MCP curation tools** (`jfs_curation_*`); no `jf` CLI
+> equivalent is used in this path. See the skill's `compatibility` note.
+
+Root-causing a curation-attributable failure (`ETARGET`, `403`, a version
+missing from the index, a waiver not taking effect) is a multi-step
+investigation — preflight checks, the two-gate model, symptom classification,
+then a full RCA procedure. It doesn't belong inline here since a plain
+download never touches it. **Open
+[references/rca-procedure.md](references/rca-procedure.md) and follow it from
+the top** — one file, covering preflight, the #1 RULE, the two-gate model,
+symptom classification (Step 0), and the RCA itself (Steps 1–4, worked
+examples, gotchas).
+
+---
+
+# Check & download
+
 ## Workflow overview
 
 ```mermaid
@@ -36,7 +72,7 @@ flowchart TD
     I -->|Yes| J[Check curation policy via API]
     I -->|No| K[Download via remote repo]
     J -->|200 Allowed| K
-    J -->|403 Blocked| M[Report curation blocked — stop]
+    J -->|403 Blocked| M[Report curation blocked — see Troubleshoot a failure]
 ```
 
 ### Parallelization opportunities
@@ -207,7 +243,10 @@ fi
   download via a remote repo (same as Step 6b).
 - **`returned 403` on stderr** → package is **blocked** by a curation
   policy. The response body explains which policy rule blocked it. Report
-  the block reason to the user and stop — do not attempt to download.
+  the block reason to the user and stop — do not attempt to download. For
+  root-cause detail beyond the block reason (why this version specifically,
+  whether a waiver applies, what to use instead), see **Troubleshoot a
+  failure** above.
 - **Any other non-zero exit** → treat as an operational failure (auth, DNS,
   endpoint disabled) and report.