Menu
Sign and verify agent skill folders with ed25519 keys. Detect tampering, manage trusted authors, and track provenance chains (isnād).
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Persistent memory system for AI agents following Model Context Protocol (MCP). Use for storing long-term memories across sessions, semantic search of past knowledge, building knowledge graphs, auto-injecting context, deduplicating memories, syncing to cloud storage. Essential for agents that need to remember decisions, solutions, preferences, and learned patterns over time.
Persistent memory system for AI agents following Model Context Protocol (MCP). Use for storing long-term memories across sessions, semantic search of past knowledge, building knowledge graphs, auto-injecting context, deduplicating memories, syncing to cloud storage. Essential for agents that need to remember decisions, solutions, preferences, and learned patterns over time.
Master REST and GraphQL API design principles to build intuitive, scalable, and maintainable APIs that delight developers. Use when designing new APIs, reviewing API specifications, or establishing API design standards.
API design principles and decision-making. REST vs GraphQL vs tRPC selection, response formats, versioning, pagination.
Complete App Store Optimization (ASO) toolkit for researching, optimizing, and tracking mobile app performance on Apple App Store and Google Play Store
Create SEO-optimized marketing content with consistent brand voice. Includes brand voice analyzer, SEO optimizer, content frameworks, and social media templates. Use when writing blog posts, creating social media content, analyzing brand voice, optimizing SEO, planning content calendars, or when user mentions content creation, brand voice, SEO optimization, social media marketing, or content strategy.
| name | skillsign |
| version | 1.0.0 |
| description | Sign and verify agent skill folders with ed25519 keys. Detect tampering, manage trusted authors, and track provenance chains (isnād). |
Cryptographic signing and verification for agent skill folders using ed25519 keys. Protects your skills from tampering and lets you verify who wrote them.
pip3 install cryptography
That's the only dependency. The tool is a single Python file.
python3 skillsign.py keygen
python3 skillsign.py keygen --name myagent
Creates an ed25519 keypair in ~/.skillsign/keys/. Share the .pub file. Keep the .pem file secret.
python3 skillsign.py sign ./my-skill/
python3 skillsign.py sign ./my-skill/ --key ~/.skillsign/keys/myagent.pem
Hashes every file (SHA-256), builds a manifest, signs it with your private key. Creates .skillsig/ inside the folder.
python3 skillsign.py verify ./my-skill/
Detects modified, added, or removed files. Verifies the cryptographic signature. Shows whether the signer is trusted.
python3 skillsign.py inspect ./my-skill/
Shows signer fingerprint, timestamp, file count, and all covered files with their hashes.
python3 skillsign.py trust ./their-key.pub
Adds a public key to your local trusted authors list.
python3 skillsign.py trusted
python3 skillsign.py chain ./my-skill/
Shows the full signing history — every author who signed the folder, in order.
# First time: create your identity
python3 skillsign.py keygen --name parker
# Sign your skills
python3 skillsign.py sign ~/.openclaw/skills/my-skill/
# Later: check nothing changed
python3 skillsign.py verify ~/.openclaw/skills/my-skill/
# ✅ Verified — 14 files intact.
# Signer: ca3458e92b73e432 [TRUSTED]
# Someone tampers with a file:
python3 skillsign.py verify ~/.openclaw/skills/my-skill/
# ❌ TAMPERED — Files changed since signing:
# ~ main.py (modified)
# Trust another agent's key
python3 skillsign.py trust ./other-agent.pub
# View full provenance
python3 skillsign.py chain ~/.openclaw/skills/my-skill/
# === Isnād: my-skill/ (2 links) ===
# [1] ca3458e92b73e432 [TRUSTED]
# ↓
# [2] f69159d8a25e8e32 [UNTRUSTED]