{"skill":{"slug":"skillsign","displayName":"Skillsign — ed25519 Skill Signing","summary":"Sign and verify agent skill folders with ed25519 keys. Detect tampering, manage trusted authors, and track provenance chains (isnād).","description":"---\nname: skillsign\nversion: 1.0.0\ndescription: Sign and verify agent skill folders with ed25519 keys. Detect tampering, manage trusted authors, and track provenance chains (isnād).\n---\n\n# skillsign\n\nCryptographic signing and verification for agent skill folders using ed25519 keys. Protects your skills from tampering and lets you verify who wrote them.\n\n## Install\n\n```bash\npip3 install cryptography\n```\n\nThat's the only dependency. The tool is a single Python file.\n\n## Commands\n\n### Generate a signing identity\n```bash\npython3 skillsign.py keygen\npython3 skillsign.py keygen --name myagent\n```\nCreates an ed25519 keypair in `~/.skillsign/keys/`. Share the `.pub` file. Keep the `.pem` file secret.\n\n### Sign a skill folder\n```bash\npython3 skillsign.py sign ./my-skill/\npython3 skillsign.py sign ./my-skill/ --key ~/.skillsign/keys/myagent.pem\n```\nHashes every file (SHA-256), builds a manifest, signs it with your private key. Creates `.skillsig/` inside the folder.\n\n### Verify a skill folder\n```bash\npython3 skillsign.py verify ./my-skill/\n```\nDetects modified, added, or removed files. Verifies the cryptographic signature. Shows whether the signer is trusted.\n\n### Inspect signature metadata\n```bash\npython3 skillsign.py inspect ./my-skill/\n```\nShows signer fingerprint, timestamp, file count, and all covered files with their hashes.\n\n### Trust an author\n```bash\npython3 skillsign.py trust ./their-key.pub\n```\nAdds a public key to your local trusted authors list.\n\n### List trusted authors\n```bash\npython3 skillsign.py trusted\n```\n\n### View provenance chain (isnād)\n```bash\npython3 skillsign.py chain ./my-skill/\n```\nShows the full signing history — every author who signed the folder, in order.\n\n## When to Use\n\n- **After installing a new skill** — verify it hasn't been tampered with\n- **Before running untrusted code** — check who signed it and whether you trust them\n- **Periodically** — re-verify your skill folders to detect unauthorized modifications\n- **When publishing skills** — sign your work so others can verify it came from you\n- **When auditing your agent's integrity** — run verify on all your skill folders\n\n## Example Workflow\n\n```bash\n# First time: create your identity\npython3 skillsign.py keygen --name parker\n\n# Sign your skills\npython3 skillsign.py sign ~/.openclaw/skills/my-skill/\n\n# Later: check nothing changed\npython3 skillsign.py verify ~/.openclaw/skills/my-skill/\n# ✅ Verified — 14 files intact.\n#    Signer: ca3458e92b73e432 [TRUSTED]\n\n# Someone tampers with a file:\npython3 skillsign.py verify ~/.openclaw/skills/my-skill/\n# ❌ TAMPERED — Files changed since signing:\n#    ~ main.py (modified)\n\n# Trust another agent's key\npython3 skillsign.py trust ./other-agent.pub\n\n# View full provenance\npython3 skillsign.py chain ~/.openclaw/skills/my-skill/\n# === Isnād: my-skill/ (2 links) ===\n#   [1] ca3458e92b73e432 [TRUSTED]\n#       ↓\n#   [2] f69159d8a25e8e32 [UNTRUSTED]\n```\n","tags":{"latest":"1.1.0","cryptography":"1.0.0","ed25519":"1.0.0","security":"1.0.0","signing":"1.0.0","verification":"1.0.0"},"stats":{"comments":0,"downloads":2504,"installsAllTime":94,"installsCurrent":3,"stars":3,"versions":2},"createdAt":1769831529109,"updatedAt":1779076525626},"latestVersion":{"version":"1.1.0","createdAt":1769833814240,"changelog":"Added key revocation system. New commands: revoke, revoked.\n  Timestamp-aware verification.","license":null},"metadata":null,"owner":{"handle":"felmonon","userId":"s1712jt4r078aedvwrn06q6tpn885k9m","displayName":"FELMONON","image":"https://avatars.githubusercontent.com/u/125313419?v=4"},"moderation":{"isSuspicious":false,"isMalwareBlocked":false,"verdict":"clean","reasonCodes":["review.llm_review"],"summary":"Review: review.llm_review","engineVersion":"v2.4.24","updatedAt":1779918088754}}