| name | skill-signing-verifier |
| description | Scaffold for verifying skill package signatures and provenance (planned). Use when designing supply-chain checks. NOT for live signing or key management. |
| user-invocable | false |
| license | MIT |
| metadata | {"author":"wyattowalsh","version":"0.1.0","internal":true} |
Skill Signing Verifier
Later-tier scaffold for skill package signature verification.
Scope: Design placeholder only. Does not sign packages or manage private keys.
Planned Workflow
- Load packaged skill ZIP output from the repo packaging dry-run.
- Verify signature manifest against maintainer trust store (TBD).
- Report pass/fail without mutating installed harness skills.
Validation Contract
uv run python skills/skill-signing-verifier/scripts/check.py
Critical Rules
- Never commit or print private signing keys.
- Route live signing to maintainer-controlled release tooling when implemented.
- Pair with security-scanner for executable-surface review until signing ships.