PromptSign
PKI for AI instruction files

Sign the prompts
your agents obey.

Know who wrote the skills, agents, and CLAUDE.md / AGENTS.md files your AI runs — and be sure not one line, or the scripts they ship, has changed since. If a publisher turns out to be untrustworthy, their signature can be revoked.

A signature proves who published this and that it hasn't changed — not that it's safe.

Verify a skill or agentSign your skill or agent
signed · sealed · verifiable offline
What a signature gives you

Four guarantees and one honest limit.

✓
Origin authenticationprovided

You know exactly who published a skill — a named identity, never a bare checkmark.

✓
Integrityprovided

You know not one byte — including the scripts a skill ships — has changed since signing.

✓
Accountabilityprovided

Keyless signatures are recorded in a public transparency log that cannot be quietly rewritten.

✓
Revocabilityprovided

A compromised key or a bad actor can be revoked, so consumers stop trusting them.

✕
Harmlessnessnot provided

A valid signature on a prompt-injection payload is still a prompt-injection payload. Signing is provenance, not safety.

Start in a terminal, or right here.

The command-line tool signs and verifies, and plugs into Claude Code & Codex hooks that automatically block any instructions that are unsigned or have been tampered with. Prefer not to install anything? The in-browser tools do the same thing — and nothing you drop in ever leaves your computer.

Try the signerRead the docs
Sign as your login
promptsign login && promptsign sign ./my-skill
Verify anything
promptsign verify ./my-skill
How it works

Proof of origin you can check yourself — even offline.

  1. 01

    Fingerprint every file

    PromptSign takes a tamper-evident fingerprint (a SHA-256 hash) of every file in the skill — including any scripts it ships. Change a single byte later and the fingerprint no longer matches.

  2. 02

    Sign it under a verified identity

    The publisher signs those fingerprints by logging in with an account you already recognize — GitHub, Google, or a company account — so the identity on the signature is confirmed, not typed.

  3. 03

    Ships with the skill

    The signature travels with the skill in a small .promptsign/bundle.json file. To check it, PromptSign re-fingerprints every file and confirms the signature — no server or internet connection required.

.promptsign/bundle.json
{
  "schema": "promptsign/bundle/v1",
  "envelope": {
    "payloadType": "application/vnd.promptsign.manifest+json",
    "payload": "eyJzY2hlbWEiOiJwcm9tcHRzaWduL21hbmlmZXN0...",
    "signatures": [
      { "keyid": "a1b2c3d4e5f6…", "sig": "MEUCIQD…" }
    ]
  },
  "signer": {
    "identity": "alice@trailofbits.com",
    "scheme": "keyless",
    "issuer": "https://accounts.google.com",
    "certChain": ["MIICzDCCAlKg…"]
  },
  "transparency": { "logIndex": 51236401 }
}

Notice the identity — confirmed by a real login and named by every verifier. Never a bare green check.