Adding Signature Verification to AI Skill Packs
csinye · reddit · 2026-07-18
The author developed an open-source protocol and CLI for signing and verifying AI agent skills: skillerr.
Core design features include:
- Packaging skills into encapsulated .skill files
- Applying content addressing and SHA-256 checksums to the entire skill pack so any alteration is detectable
- Using typed contracts to describe inputs, permissions, prohibited actions, and human review requirements, rather than letting agents interpret free text
- Optional Ed25519 signatures anchored via Sigstore/Rekor transparency logs for independent verification
Usage allows inspecting before running: skill inspect my-skill.skill --trust --claims, or importing existing SKILL.md files to generate a skill pack. By default, unsigned packages will not execute unless explicitly run with --allow-untrusted.
The project splits the protocol and CLI into two packages, enabling others to build different implementations on the same standard without foracking. The author is actively seeking feedback from those implementing agent skills in production.
More from coding & agent
- Codex tip: use Sol with Astra and Luna sub-agents to save usage — pvncher · 2026-09-11
- agents-best-practices: a provider-neutral Agent Skill for designing and auditing agentic harnesses — tom_doerr · 2026-09-11
- Cognition's SWE-2 uses a KKT duality argument in RL to shift the effort Pareto curve — YouJiacheng · 2026-09-11
- First-ever Three.js Conference lands in Paris, with a panel on AI-shortened design workflows — OdinLovis · 2026-09-11
- Data engineering, not agent frameworks, is the real bottleneck for enterprise AI agents — dhruv2038 · 2026-09-11
- RTK Terminal Compression Cuts Tokens but Leaves Your AI Coding Bill Unchanged — Bartaseth · 2026-09-11