PromptSign Brings Sigstore Signing and Verification to AI Instruction Files

Summary

PromptSign is a work-in-progress tool for establishing persistent identity and integrity checks for AI skills, which are commonly distributed as editable Markdown files. Authors authenticate with GitHub, Google, or Microsoft, then PromptSign uses Sigstore’s short-lived certificate and a locally generated ephemeral Ed25519 key to sign a manifest of hashes for every file in a skill directory. The manifest is wrapped in a DSSE envelope and timestamped in Rekor; a bundle stored in a `.promptsign` directory contains the envelope, certificate, and Rekor receipt, allowing later offline verification. Policy files can require a particular publisher and issuer, while trust-on-first-use records the first signer for a skill name and rejects later signatures from different identities. Hooks for Claude Code and Codex can report or block failures at session start and tool use, and OpenClaw can prevent tampered skills from reaching disk. A browser workflow relays Sigstore requests through an allowlisted proxy, but only paths and hashes leave the tab. The author stresses that signatures prove provenance and integrity, not that a skill is safe; unsigned skills are not necessarily malicious, and content scanning remains necessary. Rekor permanently exposes the signer’s email, while filenames are not published. The project is Apache 2.0, but its CLI binaries currently lack platform signing or notarization.