Releases·Tool Release
Show HN: PromptSign – Sigstore signing and verification for AI instruction files
A developer released PromptSign, a tool applying Sigstore signing and verification to AI instruction files such as skills and prompts. It addresses provenance gaps: AI instructions are freely modifiable markdown, so users cannot verify who authored them, whether the running version matches what was installed, or if updates come from the original source. The tool also enables publisher whitelisting, letting users install only from trusted skill publishers.
1 engagement1 sourceThu, Sep 10, 2026, 06:03 PM
AI Overview
- PromptSign signs AI skill files via Sigstore keyless signing (GitHub/Google/Microsoft login, ephemeral Ed25519 key), storing a DSSE envelope and Rekor receipt in a .promptsign bundle that verifies offline.
- Claude Code and Codex hooks verify skill identity and integrity at session start and tool use; failing signatures block skills by default, and an install policy blocks tampered OpenClaw skills before disk.
- A policy file can pin skill name patterns to required signer identities, with trust-on-first-use failing hard on any later different signer.
- A browser flow signs and verifies without installs, relaying only manifests of paths and hashes through a narrow proxy because Fulcio and Rekor lack CORS headers.
- The author cautions signing is not a safety verdict—signed malicious skills still verify—and notes signers' emails become permanently public in Rekor's log.
Entities
Related
Products·launched
PromptSign - signing and verification for Claude Code skills to detect tampering
PromptSign signs AI agent skills and detects when their instructions change after installation. The author demonstrated the threat by tampering with a signed Claude Code skill to exfiltrate AWS credentials and environment tokens. It targets developers who install third-party skills and need to know the instructions they vetted are the ones that run.
PromptSign signs AI agent skills and detects when their instructions change after installation. The author demonstrated the threat by tampering with a signed Claude Code skill to exfiltrate AWS credentials and environment tokens. It targets developers who install third-party skills and need to know the instructions they vetted are the ones that run.
1 engagement1 sourceredditWed, Sep 9, 2026, 04:55 PM
Products·launched
Open protocol to detect tampering with AI agent memory files
This protocol makes AI agent persistent memory tamper-evident by having the agent generate a signing key, hash content, and publish hashes to an append-only log with signed roots and independent witnesses. It solves the problem of undetected memory manipulation in AI agents, benefiting developers and users of agentic systems.
This protocol makes AI agent persistent memory tamper-evident by having the agent generate a signing key, hash content, and publish hashes to an append-only log with signed roots and independent witnesses. It solves the problem of undetected memory manipulation in AI agents, benefiting developers and users of agentic systems.
8 engagement1 sourceredditThu, Aug 13, 2026, 01:32 AM
Developments·Paper
Do AI Coding Assistants Check Before They Install? A Pre-Registered Demand-Side Audit of Trust Signals in the Research Software Supply Chain
A pre-registered arXiv paper proposes auditing whether AI coding assistants read and act on machine-checkable software supply-chain trust signals before installing packages. It notes attackers have already exploited assistants via invented package names, compromised maintainer accounts, and manipulated repository text, while no prior study measured assistant use of trust signals on research software.
A pre-registered arXiv paper proposes auditing whether AI coding assistants read and act on machine-checkable software supply-chain trust signals before installing packages. It notes attackers have already exploited assistants via invented package names, compromised maintainer accounts, and manipulated repository text, while no prior study measured assistant use of trust signals on research software.
0 engagement1 sourcearxivMon, Sep 7, 2026, 04:55 PM
Products·launched
HSIP: cryptographic audit trail for AI agents
HSIP is a local security tool that gives an identity or AI agent a cryptographic signature for its actions, signing messages and logging decisions to create an immutable audit trail. It runs as a single Rust binary with no cloud dependency, addressing the need for verifiable and tamper-evident records of AI agent activity.
HSIP is a local security tool that gives an identity or AI agent a cryptographic signature for its actions, signing messages and logging decisions to create an immutable audit trail. It runs as a single Rust binary with no cloud dependency, addressing the need for verifiable and tamper-evident records of AI agent activity.
7 engagement1 sourceredditMon, Aug 24, 2026, 05:17 AM
Developments·Paper
SkillGate paper proposes runtime detection of malicious skill files in coding agents
A new arXiv paper introduces SkillGate, a cost-efficient runtime detector for malicious skill files in AI coding agents like Cursor, Claude Code, and GitHub Copilot. It targets the supply-chain risk of skill files installed via commands like npx skills add, which can exfiltrate credentials or inject backdoors. The approach aims to flag malicious Markdown-based skills without heavy overhead.
A new arXiv paper introduces SkillGate, a cost-efficient runtime detector for malicious skill files in AI coding agents like Cursor, Claude Code, and GitHub Copilot. It targets the supply-chain risk of skill files installed via commands like npx skills add, which can exfiltrate credentials or inject backdoors. The approach aims to flag malicious Markdown-based skills without heavy overhead.
0 engagement1 sourcearxivTue, Jul 28, 2026, 11:50 AM