Skillsign — ed25519 Skill Signing

This skill appears to be what it says: a local ed25519 signer/verifier for skill folders. Before installing or using it, consider the following: - Inspect the full skillsign.py file yourself (the provided excerpt was truncated here) to confirm there are no network calls or unexpected behavior in the omitted portion. - Protect private keys: the tool writes unencrypted PEM private keys to ~/.skillsign/keys with 0600 perms. If you need stronger protection, use hardware-backed keys or store privately encrypted keys. - Revocation and timestamping are local and limited: revocation is local and there is no trusted timestamping authority or immutable chain linking. A compromised private key can sign malicious updates that look legitimate in the local chain. - Use in a controlled environment: when first verifying third-party skills, run verification in an isolated environment and validate the public key out-of-band (e.g., via the author's published fingerprint) before adding to your trust list. - Source provenance: the package metadata references a GitHub URL but the registry source is unknown; prefer installing or running code from sources you can vet (e.g., a trusted repository or your own copy). If you want higher assurance, request the full, untruncated source and check that trust/revocation functions operate only on local files and do not contact external endpoints.