skill-signlisted

# skill-sign - **Version**: 1.0.3 - **License**: MIT - **Author**: Evan Song · [github.com/Songhonglei](https://github.com/Songhonglei) - **Repository**: https://github.com/Songhonglei/build-better-skills/tree/main/skills/skill-sign - **Part of**: [`build-better-skills`](https://github.com/Songhonglei/build-better-skills) suite — see [Stages](https://github.com/Songhonglei/build-better-skills#stages) for the lifecycle map. Cryptographically sign skill directories with Ed25519, so recipients can verify authenticity and detect tampering — even on machines that never met the author. ## Why real signatures (not just hashes) A plain SHA-256 of the skill detects accidental modification, but anyone can recompute the hash and re-publish under your name. **Ed25519 signatures prove both integrity AND authorship** — the verifier only needs your *public* key (safe to share), not your private one. ## Dependencies - Python ≥ 3.9 (stdlib only — `hashlib`, `json`, `base64`, `pathlib`, `argparse`) - Vendored Ed25519 implementation: `scripts/_vendor/ed25519_rfc8032.py` - Source: RFC 8032 Appendix A (public domain) - **This is NOT a pip package** — it ships in this skill directory. No `pip install` needed. - Environment variables read (all optional): `XDG_CONFIG_HOME`, `USER`, `USERNAME` ## Security model — read this first | You can detect | Without `--trust-key` | With `--trust-key <author's pubkey>` | |---|---|---| | Accidental file modification after signing | ✅ | ✅ | | sign.key