skill-signing-verifier

skill-signing-verifier94 wordsMITv0.1.0Repo-owned

skill-signing-verifier

Scaffold for verifying skill package signatures and provenance (planned). Use when designing supply-chain checks. NOT for live signing or key management.

Quick Start

Install:

npx skills add github:wyattowalsh/agents --skill skill-signing-verifier -y -g --agent antigravity --agent claude-code --agent codex --agent crush --agent cursor --agent gemini-cli --agent github-copilot --agent grok --agent opencode

Use: /skill-signing-verifier

Works with Claude Code, Gemini CLI, OpenCode, and other agentskills.io-compatible agents.

Source & provenance

This page is generated from the repository file skills/skill-signing-verifier/SKILL.md by wagents docs generate.

What It Does

Later-tier scaffold for skill package signature verification.

Note

This is an auto-invoke skill — it activates automatically when the agent detects relevant context. It is not visible in the / slash command menu.

Critical Rules

1. Never commit or print private signing keys.
2. Route live signing to maintainer-controlled release tooling when implemented.
3. Pair with security-scanner for executable-surface review until signing ships.

Public Metadata

Field	Value
Source Type	repo-owned
Display Source	github:wyattowalsh/agents
Source Kind	repo
Installability	portable command
Review State	reviewed
Target Agents	antigravity, claude-code, codex, crush, cursor, gemini-cli, github-copilot, grok, opencode

General

Field	Value
Name	skill-signing-verifier
License	MIT
Version	0.1.0
Author	wyattowalsh

Claude Code

Field	Value
User Invocable	No

View Full SKILL.md

---
name: skill-signing-verifier
description: >-
  Scaffold for verifying skill package signatures and provenance (planned).
  Use when designing supply-chain checks. NOT for live signing or key management.
user-invocable: false
license: MIT
metadata:
  author: wyattowalsh
  version: "0.1.0"
  internal: true
---

# Skill Signing Verifier

Later-tier scaffold for skill package signature verification.

**Scope:** Design placeholder only. Does not sign packages or manage private keys.

## Planned Workflow

1. Load packaged skill ZIP output from the repo packaging dry-run.
2. Verify signature manifest against maintainer trust store (TBD).
3. Report pass/fail without mutating installed harness skills.

## Validation Contract

```bash
uv run python skills/skill-signing-verifier/scripts/check.py
```

## Critical Rules

1. Never commit or print private signing keys.
2. Route live signing to maintainer-controlled release tooling when implemented.
3. Pair with security-scanner for executable-surface review until signing ships.

Download from GitHub

Resources

Skill CatalogBrowse custom and external skills.

CLI ReferenceInstall and manage skills.

agentskills.ioThe open ecosystem for cross-agent skills.

---

View source on GitHub