Sigildex
npm GitHub

Approval records for Agent Skills

Know what changed in an Agent Skill before you trust the update.

A small open-source CLI. It fingerprints the exact bytes of an Agent Skill a human approved and, when you run check, shows file by file whether the copy you name still matches.

$ npm install -g sigildex@0.1.2

Read the guide View on GitHub

MIT licensed · Node.js 20+ · macOS and Linux · runs locally — no server, account, database, or LLM · no network calls, no telemetry

01

Version 2 is not what you approved.

You approved version 1. Before installing version 2, check the candidate against the approval record. Here, it adds an executable script and rewrites the instructions to call it.

examples/version-drift 
$ sigildex lock skill-v1 --approval-id log-summarizer --out log-summarizer.lock.json
Locked skill-v1
  approval id:            log-summarizer
  root digest:            sha256:d445576462862500bd9537c93fc2390802d97bf3df13879a9b83cc21e04890ad
  files:                  2
  frontmatter:            ok
    name:                 log-summarizer
    description:          Summarize a plain-text application log into a short incident report — error counts, the first and last timestamp seen, and the most frequent messages. Use when …
  written to:             log-summarizer.lock.json
This records byte identity only. It does not attest safety, provenance, or future content.
$ echo $?
0

$ sigildex check skill-v1 --against log-summarizer.lock.json
Match: the artifact matches approval record log-summarizer.
  root digest:            sha256:d445576462862500bd9537c93fc2390802d97bf3df13879a9b83cc21e04890ad
  files:                  2
This records byte identity only. It does not attest safety, provenance, or future content.
$ echo $?
0

$ sigildex check skill-v2 --against log-summarizer.lock.json
Drift: the artifact no longer matches the approval record (1 added, 0 removed, 1 modified, 0 mode-changed).
  approved root digest:   sha256:d445576462862500bd9537c93fc2390802d97bf3df13879a9b83cc21e04890ad
  actual root digest:     sha256:0b0bec0d4e4435beed62b983c530f4f8249e7b1af01d31fbb8be1989d94cf1c6

  + scripts/summarize.sh (script)
  ~ SKILL.md (instructions)

Review the changes and re-lock only after approving them.
$ echo $?
2

check caught it and exited 2; sigildex diff lists each change per file, and a human decides whether to re-approve. Real output from examples/version-drift — in a project, records live in .sigildex/approvals/.

02

The workflow

Other tools find and scan a skill; you review it. Sigildex records what you approved and, when invoked, verifies whether the installed copy still matches.

  1. Other tools 01

    Discover

    Find a candidate.

    GitHub CLI gh skill, Vercel Skills CLI, publisher catalogs.

  2. Other tools 02

    Quarantine & scan

    Copy it outside every active skills directory and run nothing. Get evidence: risky patterns, injection, secrets.

    NVIDIA SkillSpector, Cisco AI Defense Skill Scanner, Snyk Agent Scan.

  3. You 03

    Review

    A person reads the skill and decides. A clean scan is evidence, not approval.

    Checklist in the adoption guide.

  4. Sigildex 04

    Record & verify

    The step Sigildex adds: remember what you approved. sigildex lock records the approved bytes' identity in an approval record beside your code; after install, sigildex check verifies the copy your agent loads. Drift exits 2 — a configured preflight or CI gate can stop there.

  5. Your tools + Sigildex 05

    Update

    When you or CI ask, your installer reports whether upstream moved (gh skill update --dry-run is one read-only way). Quarantine the new version; sigildex diff shows what changed per file; a human re-approves; lock again, install, check again.

discover → quarantine → scan → review → lock → install → check ↻ update → quarantine → diff → review → lock → install → check

The stage-by-stage guide, with quarantine and CI: docs/safe-skill-adoption.md.

03

Use it with your agent

Sigildex ships as an Agent Skill. Put it where your agent loads skills and the agent follows the workflow above: stage candidates in quarantine, run nothing bundled with them, summarize scanner output, and stop for a human decision before anything is recorded or installed. These are instructions a compliant agent follows — they reduce risk; they are not a security boundary.

Agent Skill https://sigildex.ai/SKILL.md The workflow as a skill your agent loads and follows. llms.txt https://sigildex.ai/llms.txt Routing and limits; an agent can navigate the whole project from here.

05

Limits

  • Not a safety verdict. A record proves the approved bytes are unchanged; it does not certify a skill is safe or verify where it came from — pair it with scanning and human review.
  • Not a service. No hosted index, discovery API, or publisher monitoring. Upstream update checks belong to your installer and run only when you ask; check compares the installed copy with its record, nothing more.
  • Not a directory audit. check compares one artifact against one record; duplicate ids, duplicate artifact paths, or orphaned records are for code owners and pull-request review to catch.
  • Not the spec. The identity specification is the normative contract; schemas, threat model, and CI workflow are published beside it.