Verified artifacts
Skills, agents and plugins that ship a valid signature, with the identity that signed each one. Every entry was checked by hand against a fresh clone on the date shown — and you can check it yourself, which matters more than our say-so.
The list
No third-party artifacts are listed yet. Rather than pad this page, we would rather it stay accurate: the entry below is our own, and it is marked as such. If you publish a signed skill or plugin, it belongs here.
Ours
Listed under the same rules as everything else, and separated so the list above is never inflated by our own releases. We sign what we ship because asking publishers to sign theirs would be hollow otherwise.
Verifies CLAUDE.md, skills and agent definitions before Claude Code loads them, and re-checks a skill before the Skill tool runs it.
What listing means
It means one thing: on the date shown, the files in that repository carried a valid signature from the identity named next to them, and not a byte had changed since it was signed.
It is not a safety review. A signature proves who and what, never that the contents are good, correct, or harmless. A signed skill can still do something you would not want; it simply cannot do it anonymously. Read what you install, exactly as you would unsigned.
It is a point-in-time check. Publishers cut new releases, and a listing verified last month says nothing about the version you are about to install. That is a property of every directory of this kind, and pretending otherwise would be the dishonest part. So verify the copy you actually have:
# Check any entry on this page yourself.
git clone https://github.com/PromptSign/promptsign-plugin
promptsign verify ./promptsign-pluginVerification runs offline against a pinned trust root and reports the signer itself, so it does not depend on this page being right, or on this page being up at all. See the docs for the trust model, or verify in the browser with the verifier.
Get your artifact listed
Sign a release, then tell us where it is. There is no application, no fee, and no account: the only requirement is that promptsign verify passes against your published artifact from a clean clone, because that is the whole claim the listing makes.
- Sign in CI with promptsign-sign — one step, no key to store, the workflow's own identity does the signing. The integration docs have the workflow.
- Confirm it verifies from a fresh clone:
promptsign verify ./your-artifact. - Open an issue on promptsign-verify with the repository and the identity you expect, or email info@promptsign.ai. We verify it ourselves before it goes up.
Removal is the same process in reverse, and needs no reason. If a listing is wrong or out of date, saying so is a favour to us.
The badge
Signing also earns a badge for your README, generated by your own CI from the verification that just ran — not composed from a URL, and not served by us:
It names the signer rather than showing a bare checkmark, it never names one on a failing run, and the file lives in your repository, so no third party learns who is reading your README and the badge keeps working whatever happens to us. The promptsign-verify README has the four lines of workflow that produce it.