The open trust manifest for AI-agent skills. A small signed sidecar that lets trust travel with a skill. Zero dependencies, harness-neutral, MIT.
▶ Play with it live → — attest a skill, watch its tier derive and the gate decide, entirely in your browser.
A skill you download is code + instructions that will run inside your agent, with your agent's hands — and about 1 in 4 community skills carries a vulnerability. The ecosystem's answer is the right one: "verify, then install, then constrain." But trust dies at every boundary. A skill verified in one catalog arrives in your harness as an unlabeled blob, and you re-check it from scratch or you just hope.
skillproof is a small, signed sidecar (skill.proof.json) that travels with a skill and attests four things a consumer needs before trusting it:
- provenance — who authored or derived it, from what (including the attested episodes a learned skill was distilled from)
- capabilities — the least-privilege scope it may exercise (
action+resource) - verification — which gates it passed, the reproducible evidence, and the resulting trust tier (T1–T4)
- integrity — a content hash + detached signature, checkable offline; any edit voids the proof
npm i -g @avee1234/skillproof # CLI
npm i @avee1234/skillproof # libraryRequires Node ≥ 18. No transitive dependencies.
# bind provenance + least-privilege caps, then sign
skillproof attest ./my-skill --cap fs.read:*.pdf --cap fs.write:out/** \
--signer abhi --sign ed25519 --key-file key.pem
# run static + conformance gates, derive the tier
skillproof verify ./my-skill
# verify-then-install, in one line (exit 2 to block anything below the bar)
skillproof gate ./my-skill --min-tier T3After a run, confirm the skill actually behaved inside its envelope — every side-effect approved and within the declared capabilities (the resource-precision check static analysis can't do):
skillproof audit ./my-skill run-log.jsonl # exit 2 if any effect was out-of-scope or unapprovedThe tier is derived, not asserted — the same proof always yields the same tier:
| Tier | Earned when | Read it as |
|---|---|---|
| T1 | the proof is parseable | identified, nothing more |
| T2 | signed and G1 (static safety scan) passes | authentic and not obviously dangerous |
| T3 | T2 and G4 (capability conformance) passes with declared caps | scoped to least privilege |
| T4 | T3 and external G2 (intent) + G3 (sandbox) verdicts pass | independently vetted |
G1 (static scan) and G4 (capability conformance) run with zero dependencies. G2 (intent, needs an LLM) and G3 (sandbox) verdicts are recorded from an external checker into the same evidence envelope — skillproof standardizes how they're carried, it doesn't pretend to run them.
skillproof doesn't replace your harness's approval gate or its sandbox — it produces the portable attestation your gate consumes. That's the whole reason it can stay dependency-free and harness-neutral: it needs only what every SKILL.md harness already has — a content hash, and a tool-dispatch log it can look at.
Wire skillproof hook as a skill-load gate so the harness enforces verify-then-install. It's fail-safe (any error exits 0 — it never wedges a session) and advisory by default; set SKILLPROOF_ENFORCE=1 to actually block:
{
"hooks": {
"PreToolUse": [
{ "matcher": "Skill", "hooks": [ { "type": "command", "command": "skillproof hook" } ] }
]
}
}| Command | What it does |
|---|---|
attest <dir> [--cap action:resource ...] [--signer id] [--sign hmac|ed25519 --key-file F] |
Bind provenance + caps and sign |
verify <dir> |
Run static + conformance gates, derive tier |
gate <dir> --min-tier T3 |
Verify-then-install; exit 2 if below the bar |
tier <dir> |
Print the derived tier and why |
audit <dir|proof.json> <run-log.jsonl> |
Runtime side-effect check; exit 2 if out of scope |
hook |
Claude Code skill-load hook (reads a payload on stdin) |
keygen |
Generate an ed25519 keypair (PEM) |
Published — @avee1234/skillproof v0.1.0. 23 tests, zero dependencies, Node ≥ 18. See SPEC.md for the frozen format and vision.md for the why. Grounded in the 2026 agent-skills trust research (the T1–T4 / G1–G4 governance model and the biconditional side-effect criterion), aimed at the cross-platform portability gap that work leaves open.
Part of a small family of open, harness-neutral formats for agent infrastructure — capgrant (capability grants, whose scope vocabulary skillproof reuses), provenant (provenance), handover (task handoff), worklease (fleet coordination), memport (portable memory). Same playbook throughout: own the open interoperability standard, not the runtime.
MIT © Abhi Das