Back

PromptSign makes AI skill files provably signed, not provably safe

PromptSign gives AI skill files a verifiable publisher and tamper check — but signing who wrote a prompt says nothing about whether the prompt is safe

Sigstore-style keyless signing for CLAUDE.md, AGENTS.md and skill scripts: strong on provenance, silent on intent

Core claimhigh on what it does, by the source's own admission on what it doesn't

PromptSign solves a real, narrow problem — knowing who published an AI instruction file and whether it has been altered since — using established transparency-log signing (Sigstore-style keyless identity). It does not and cannot solve the harder problem: whether the signed content is itself malicious. Treat it as an integrity layer, not a safety filter.

What it actually verifies

Skills, CLAUDE.md/AGENTS.md files, and any scripts they ship are hashed file-by-byte (SHA-256). The publisher authenticates with an existing account (GitHub, Google, Microsoft, or a company account) rather than a self-declared name, and signs those fingerprints. The signature and metadata travel with the skill in a small .promptsign/bundle.json file, and verification re-hashes every file locally — no server call required. Signatures are recorded in a public transparency log, so the record of who signed what can't be quietly rewritten, and a compromised or bad-acting publisher's trust can be revoked.

How a check works

  1. 01
    Publisher authenticates

    via GitHub/Google/Microsoft/company login

  2. 02
    Files fingerprinted

    SHA-256 over every file, including scripts

  3. 03
    Fingerprints signed

    keyless, logged in public transparency log

  4. 04
    Bundle ships with skill

    .promptsign/bundle.json

  5. 05
    Verifier re-hashes

    local, offline, no server needed

  6. 06
    Hook enforces

    Claude Code / Codex hooks block unsigned or tampered instructions

What signing proves vs. what it doesn't

Proven

  • A named, login-verified identity published this file
  • Not a single byte — including shipped scripts — has changed since signing
  • The signing event is permanently, publicly logged
  • A bad publisher's trust can be revoked going forward

Not proven

  • The instructions themselves are safe or non-malicious
  • A validly signed prompt-injection payload is still a prompt-injection payload
  • The publisher's identity itself is trustworthy, only that it's verified
  • Anything about skills that were never signed by their real author elsewhere

Deployment options

A CLI signs and verifies files and plugs directly into Claude Code and Codex hooks, automatically blocking unsigned or tampered instructions before they run. For those who prefer not to install anything, in-browser tools perform the same fingerprinting and verification client-side — file contents never leave the machine.

Sources