name	check-commit-signature
description	Checks whether a git commit is signed, including SSH-signed commits, without requiring local trust configuration. Use when the user asks if a commit is signed or to gate push behavior on signature presence.

Check Commit Signature

When to use

Use this skill when you need to answer:

"Is this commit signed?"
"Push only if commit is signed"
"Verify commit signature status"

Default method (signature present)

Use this command first:

git cat-file -p <rev> | grep "^gpgsig"

If it matches, the commit contains a signature block (GPG or SSH).
If it does not match, the commit is unsigned.

Recommended default revision:

git cat-file -p HEAD | grep "^gpgsig"

Why this is the default

git log --show-signature or %G? can report N for valid SSH-signed commits when local trust is not configured (for example, missing gpg.ssh.allowedSignersFile).

Presence-checking gpgsig answers the practical question "is the commit signed?" without depending on local verifier config.

Optional stricter verification

If trust config is known to be set up, add:

git log -1 --show-signature <rev>

Report this separately as "verified locally" vs "signed but not locally verifiable."

name	check-commit-signature
description	Checks whether a git commit is signed, including SSH-signed commits, without requiring local trust configuration. Use when the user asks if a commit is signed or to gate push behavior on signature presence.