# chainctl skills harden

URL: https://edu.chainguard.dev/platform/chainctl/chainctl-docs/chainctl_skills_harden.md
Last Modified: September 22, 2026
Tags: chainctl, Reference, Product

 chainctl skills harden Submit a skill for server-side hardening.
Synopsis Submit a skill to the Skills API for server-side hardening. Pass a local path or use –folder to package and upload a directory; SKILL.md supplies the skill name. An uploads registry reference uses an existing artifact. –digest uses an artifact already uploaded to uploads.cgr.dev/ORG/NAME and requires –name. The digest must be sha256:<64-hex>, not a tag or a full reference. –group is required and accepts an organization name or UIDP.
Prints the job ID and status after submission. With –wait, polls until the job finishes, downloads the result to ./hardened/NAME, and prints its reference and digest. HARDENING.md in the download contains the report and scanner findings. –timeout bounds the command when waiting. A timeout or interrupt leaves the server-side job running.
Submitting unchanged content to the same organization as the same user returns the same job ID. Use skills status to check a saved job ID or resume waiting without uploading again.
chainctl skills harden [<path|uploads-ref>] --group <org> [flags] Examples chainctl skills harden --group my-org ./my-skill --wait --timeout 30m chainctl skills harden --folder ./my-skill --group my-org chainctl skills harden uploads.cgr.dev/my-org/my-skill:latest --group my-org --wait chainctl skills harden --digest sha256:<64-hex> --name my-skill --group my-org chainctl skills status --group my-org --id <job-id> --wait Options --digest string SHA256 digest of an artifact already in the uploads registry. --folder string Local skill directory containing SKILL.md. -g, --group string Target organization name or UIDP (required). --name string Uploaded skill name (required with --digest). --timeout duration Maximum command duration with --wait (0 means no timeout). --wait Wait for hardening to finish. Options inherited from parent commands --api string The url of the Chainguard platform API. (default "https://console-api.enforce.dev") --audience string The Chainguard token audience to request. (default "https://console-api.enforce.dev") --config string A specific chainctl config file. Uses CHAINCTL_CONFIG environment variable if a file is not passed explicitly. --console string The url of the Chainguard platform Console. (default "https://console.chainguard.dev") --force-color Force color output even when stdout is not a TTY. -h, --help Help for chainctl --issuer string The url of the Chainguard STS endpoint. (default "https://issuer.enforce.dev") --log-level string Set the log level (debug, info) (default "ERROR") -o, --output string Output format. One of: [csv, env, go-template, id, json, markdown, none, table, terse, tree, wide] -v, --v int Set the log verbosity level. SEE ALSO chainctl skills	- Skills registry related commands.