PromptSign
PKI for AI instruction files

Sign the prompts
your agents obey.

Know who published the skills, agents, and CLAUDE.md / AGENTS.md files your AI runs, and verify that neither they nor the scripts they ship have changed since they were signed.

If a publisher becomes untrustworthy, revoke their trust.

A signature proves who published this and that it hasn't changed. It does not prove that it's safe.

Sign your skill or agentVerify a skill or agent
signed · sealed · verifiable offline
What a signature gives you

Four guarantees. One limit.

✓
Origin authenticationprovided

You know exactly who published a skill: a named identity, never a bare checkmark.

✓
Integrityprovided

You know not one byte, including the scripts a skill ships, has changed since signing.

✓
Accountabilityprovided

Keyless signatures are recorded in a public transparency log that cannot be quietly rewritten.

✓
Revocabilityprovided

A compromised key or a bad actor can be revoked, so consumers stop trusting them.

✕
Harmlessnessnot provided

A valid signature on a prompt-injection payload is still a prompt-injection payload. Signing is provenance, not safety.

Start in a terminal, or right here.

The command-line tool signs and verifies, and plugs into Claude Code & Codex hooks that automatically block any instructions that are unsigned or have been tampered with.

Prefer not to install anything? The in-browser tools do the same thing, and nothing in the files content you drop in leaves your computer.

Try the signerRead the docs
Sign as your login
promptsign login && promptsign sign ./my-skill
Verify anything
promptsign verify ./my-skill
How it works

Proof of origin you can check yourself, even offline.

  1. 01

    Fingerprint every file

    PromptSign takes a tamper-evident fingerprint (a SHA-256 hash) of every file in the skill, including any scripts it ships. Change a single byte later and the fingerprint no longer matches.

  2. 02

    Sign it under a verified identity

    The publisher signs those fingerprints by authenticating with an account you already recognize, such as GitHub, Google, Microsoft, or a company account, so the identity on the signature is verified, not self-declared.

  3. 03

    Ships with the skill

    The signature travels with the skill in a small .promptsign/bundle.json file. To check it, PromptSign re-fingerprints every file and confirms the signature, no server or internet connection required.

.promptsign/bundle.json
{
  "schema": "promptsign/bundle/v1",
  "envelope": {
    "payloadType": "application/vnd.promptsign.manifest+json",
    "payload": "eyJzY2hlbWEiOiJwcm9tcHRzaWduL21hbmlmZXN0...",
    "signatures": [
      { "keyid": "a1b2c3d4e5f6…", "sig": "MEUCIQD…" }
    ]
  },
  "signer": {
    "identity": "alice@trailofbits.com",
    "scheme": "keyless",
    "issuer": "https://accounts.google.com",
    "certChain": ["MIICzDCCAlKg…"]
  },
  "transparency": { "logIndex": 51236401 }
}

Notice the identity — confirmed by a real login and named by every verifier. Never a bare green check.