Skillsign — ed25519 Skill Signing

**Judgement:** A focused, technically sound signing/verification utility that can significantly improve integrity and provenance management for OpenClaw skill folders, assuming `cryptography` is available and teams are willing to manage keys. **What it does well** - Uses modern primitives (SHA-256 + ed25519) to sign skill-folder manifests and verify them later. - Catches a broad range of tampering (modified, added, or deleted files) relative to the original signed state. - Provides clear CLI commands: `keygen`, `sign`, `verify`, `inspect`, `trust`, `trusted`, and `chain`. - Maintains a local trust list so you can distinguish trusted vs. untrusted signers. - Provenance chain (isnād) is especially useful to understand multi-author or re-signed skills over time. **Key risks & limitations** - **Key management risk:** Loss or compromise of the private key means you either lose signing continuity or an attacker could sign malicious skills in your name. There’s no built-in revocation or rotation policy. - **Local-only trust model:** Trust is stored locally; different machines or environments may have inconsistent trust sets unless explicitly synchronized. - **No code-safety guarantees:** It ensures integrity and authorship, but does not analyze or sandbox the skill code—signed code can still be malicious. - **Operational overhead:** Teams must adopt processes for distributing public keys, updating trusted lists, and deciding trust policies. **Recommended scenarios** - You distribute or consume skills across machines or teams and want a straightforward way to verify that folders are unmodified and actually authored by specific identities. - You operate a skill marketplace or internal registry and want a lightweight signing standard for submissions. - You run agents in sensitive environments (production, regulated contexts) and need periodic integrity audits of installed skills. - You want reproducible, auditable provenance chains for skills as they evolve and are re-signed by different maintainers.