PromptSign

PromptSign is an open wire format and toolset for signing the instruction files used by AI coding agents. It covers artifacts such as SKILL.md bundles, CLAUDE.md, AGENTS.md, and agent definitions, including the scripts and assets packaged with them. The goal is to let a person, marketplace, CI system, or agent harness confirm who published an instruction bundle, whether its contents changed after signing, and whether a previously trusted release has been revoked. That matters because these files enter a model's working context and can influence commands, file edits, and other actions, yet they often move between repositories and marketplaces without the origin checks expected for executable software.

The project separates the signing format from any single implementation. Its specification repository defines the manifest, canonicalization, bundle, policy, keyless, and revocation formats, then uses a conformance suite to keep two implementations in agreement. One implementation is a Rust verification library with a Node binding published as @promptsign/verify. The other is a zero-dependency Node reference implementation written from the specification. That split is useful for teams considering a shared standard because a bug or undocumented behavior in one codebase doesn't automatically become the format. The project states that interoperability with Sigstore tooling is intended, and its bundles carry standard certificate chains and transparency log entries.

For hands-on use, PromptSign provides a static command line binary that can sign a bundle, verify one file or a whole tree, and enforce trust policy inside agent hooks. Keyless signing uses OpenID Connect to bind a short-lived key to an identity. The signature is recorded in a public transparency log, and the temporary key is discarded instead of becoming a long-lived secret that must be stored and rotated. GitHub Actions can use its ambient OIDC identity, which makes the release workflow itself the named signer. Verification can then run offline against cached trust roots. Purposeful exit codes distinguish normal success, usage errors, and enforcement failures, so the command can block an agent hook or fail a CI job when a policy check doesn't pass.

PromptSign fits security teams, maintainers of agent skill collections, registry operators, and developers distributing reusable instruction bundles. A publisher can sign a complete release in automation, while a consumer can pin an expected identity and verify the downloaded files before an agent reads them. Marketplace or harness builders can embed the Rust verifier through its Node binding instead of spawning the command line tool. The browser also offers sign and verify workflows for someone evaluating the format without immediately wiring it into CI. Because the signature covers the whole bundle, checks extend beyond the visible Markdown to bundled scripts and other files that may be executed by the host. Dedicated GitHub Actions helpers are available for signing releases and checking that instruction files carry the expected publisher identity on pull requests.

The most important boundary is stated plainly by the project. A valid signature proves origin and integrity, not harmlessness. A publisher can sign malicious instructions, so interfaces should show the verified identity instead of a context-free checkmark that users might read as a safety guarantee. Revocation and transparency improve accountability, while review, sandboxing, and behavioral controls still have separate jobs. There is also an unavoidable bootstrap issue. The first verifier binary cannot authenticate itself, so its initial archive should be checked with an already trusted mechanism such as a GitHub attestation. Once a trusted copy exists, it can verify later releases.

PromptSign is open source under the Apache License 2.0, with separate repositories for the specification, CLI, Rust core, Node reference, GitHub Actions helpers, and a Claude Code plugin. The CLI is distributed as a signed release binary from the project documentation rather than as the contents of the similarly named npm package, which points users to the binary. That packaging choice and the need to establish an initial trust root add setup work, but the documentation explains both directly. There is no paid plan presented as the main way to use the project. For teams that need verifiable provenance for AI instruction files and are willing to define trusted publisher identities, it provides a focused standard and practical enforcement components without claiming to solve prompt safety by itself.