diff --git a/README.md b/README.md
index 44c03d5..d6b3734 100644
--- a/README.md
+++ b/README.md
@@ -13,9 +13,10 @@ Delivers the JFrog skills to OpenAI Codex. **Phase 1: skills only** (no MCP yet)
 ## Skills
 
 - `jfrog` — interact with the JFrog Platform (CLI, MCP, REST/GraphQL).
+- `jfrog-ai-catalog-skills` — discover, install, manage, and publish agent skills from the JFrog AI Catalog via `jf skills` and Agent Guard.
 - `jfrog-package-safety-and-download` — package safety checks and Artifactory-routed downloads.
 
-Skills are vendored from [`jfrog/jfrog-skills`](https://github.com/jfrog/jfrog-skills), pinned in `scripts/sync-skills-vendor.json`. Bump the pin and run `npm run sync-skills` to update.
+Skills are vendored from [`jfrog/jfrog-skills`](https://github.com/jfrog/jfrog-skills), pinned in `scripts/sync-skills-vendor.json`. Bump the pin and run `npm run sync-skills` to update. See [`VENDOR.md`](VENDOR.md) for the full picture.
 
 ## Development
 
diff --git a/VENDOR.md b/VENDOR.md
new file mode 100644
index 0000000..5396ead
--- /dev/null
+++ b/VENDOR.md
@@ -0,0 +1,26 @@
+# Vendored skills
+
+The skill packages under `skills/` are vendored from **[jfrog/jfrog-skills](https://github.com/jfrog/jfrog-skills)** and committed to `main`.
+
+| | |
+| --- | --- |
+| **Repository** | https://github.com/jfrog/jfrog-skills |
+| **Pinned release** | see `pin` in [`scripts/sync-skills-vendor.json`](scripts/sync-skills-vendor.json) |
+
+Included directories: `jfrog/`, `jfrog-ai-catalog-skills/`, `jfrog-package-safety-and-download/` (as of the pinned release).
+
+## Refreshing
+
+When the upstream repo publishes a new release, refresh the vendored tree via a PR that:
+
+1. Bumps `pin` in [`scripts/sync-skills-vendor.json`](scripts/sync-skills-vendor.json) to the new tag.
+2. Re-syncs and commits the refreshed `skills/` tree.
+3. Bumps `version` in [`.codex-plugin/plugin.json`](.codex-plugin/plugin.json) so the published plugin version reflects the new skills bundle.
+
+To regenerate the tree locally before opening the PR:
+
+```bash
+node scripts/sync-skills.mjs
+```
+
+The script reads its sibling [`sync-skills-vendor.json`](scripts/sync-skills-vendor.json), downloads the pinned upstream tarball from `codeload.github.com`, and replaces the directories listed in `paths` (today: `skills/`).