New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Implementing Code Signing For Artifacts

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Implements code signing for build artifacts (binaries, packages, containers) using GPG, Sigstore, and platform-specific signing tools, establishing trust chains and verifying signatures in…

Apache-2.0Auto-check passedMobile

Install Implementing Code Signing For Artifacts

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-code-signing-for-artifacts -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills implementing-code-signing-for-artifacts --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/implementing-code-signing-for-artifacts .claude/skills/implementing-code-signing-for-artifacts && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
implementing-code-signing-for-artifacts
GitHub stars
34k
Token cost
~1.8k tokens
SKILL.md length
433 words
Files
8 (incl. scripts, references, assets)
Skills in repo
637
Repo updated
First seen
Licence
Apache-2.0

At a glance

Implements code signing for build artifacts (binaries, packages, containers) using GPG, Sigstore, and platform-specific signing tools, establishing trust chains and verifying signatures in…

  • Works in 4 steps: Generate and Manage Signing Keys → Sign Build Artifacts in CI/CD → Verify Signatures in Deployment Pipeline → …
  • Establishing artifact integrity checks against supply-chain tampering
  • SKILL.md covers When to Use, Prerequisites, Workflow and Key Concepts, plus 3 more sections
  • Runs Python scripts from its folder; calls npm; reaches token.actions.githubusercontent.com and search.sigstore.dev; needs GPG_PRIVATE_KEY

What it does

Implementing Code Signing For Artifacts is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Implements code signing for build artifacts (binaries, packages, containers) using GPG, Sigstore, and platform-specific signing tools, establishing trust chains and verifying signatures in deployment pipelines. Use when establishing artifact integrity checks against supply-chain tampering, proving authenticity to customers, building zero-trust pipelines that reject unsigned artifacts, or meeting SLSA Level 2+ provenance requirements.

Its SKILL.md is about 1.8k tokens, which your agent loads only when the skill is triggered. The skill folder holds 10 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/api-reference.md` and `references/standards.md`).

It sits in Mobile, covering App store release, Supply chain security and CI/CD. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Establishing artifact integrity checks against supply-chain tampering
  • Proving authenticity to customers
  • Building zero-trust pipelines that reject unsigned artifacts
  • Meeting SLSA Level 2+ provenance requirements

Example prompts

  • “Use the implementing-code-signing-for-artifacts skill to implement code signing for build artifacts (binaries, packages, containers) using GPG…”
  • “/implementing-code-signing-for-artifacts”

Requirements

  • Python 3
  • A credential in GPG_PRIVATE_KEY

Workflow steps

4 steps, taken from the step headings in SKILL.md.

  1. Generate and Manage Signing Keys
  2. Sign Build Artifacts in CI/CD
  3. Verify Signatures in Deployment Pipeline
  4. Sign npm Packages with Provenance

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    Shell commands in SKILL.md call:

    • npm

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Hosts in commands or code, which the agent is likely to contact:

    • token.actions.githubusercontent.com
    • search.sigstore.dev

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names these keys or tokens, usually read from environment variables:

    • GPG_PRIVATE_KEY

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Implementing Code Signing For Artifacts loads about 1.8k tokens when it runs, and up to ~3.1k if it reads all its reference files. Until then it costs about 119 tokens; SKILL.md has 433 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~119
When it runs · the whole SKILL.md, loaded when a task matches
~1.8k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~3.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 433 words, ~1,832 tokens.

Download SKILL.mdSave it as .claude/skills/implementing-code-signing-for-artifacts/SKILL.md (or your agent's skills folder). This skill also uses 7 other files; get the full folder from GitHub.
name
implementing-code-signing-for-artifacts
description
Implements code signing for build artifacts (binaries, packages, containers) using GPG, Sigstore, and platform-specific signing tools, establishing trust chains and verifying signatures in deployment pipelines. Use when establishing artifact integrity checks against supply-chain tampering, proving authenticity to customers, building zero-trust pipelines that reject unsigned artifacts, or meeting SLSA Level 2+ provenance requirements.
domain
cybersecurity
subdomain
devsecops
tags
devsecops, cicd, code-signing, supply-chain, sigstore, secure-sdlc
version
1.0.0
author
mahipal
license
Apache-2.0
nist_csf
PR.PS-01, GV.SC-07, ID.IM-04, PR.PS-04
mitre_attack
T1195, T1554, T1059.004, T1610, T1611

Implementing Code Signing for Artifacts

When to Use

  • When establishing artifact integrity verification to prevent supply chain tampering
  • When compliance requires cryptographic proof that build artifacts are authentic and unmodified
  • When distributing software to customers who need to verify publisher identity
  • When implementing zero-trust deployment pipelines that reject unsigned artifacts
  • When meeting SLSA Level 2+ requirements for provenance and integrity

Do not use for encrypting artifacts (signing provides integrity, not confidentiality), for container image signing specifically (use cosign), or for source code authentication (use commit signing).

Prerequisites

  • GPG key pair for traditional signing or Sigstore account for keyless signing
  • Code signing certificate from a Certificate Authority for public distribution
  • CI/CD pipeline with access to signing keys or identity provider
  • Verification infrastructure in deployment pipelines

Workflow

Step 1: Generate and Manage Signing Keys
bash
# Generate GPG key for artifact signing
gpg --full-generate-key --batch <<EOF
Key-Type: eddsa
Key-Curve: ed25519
Subkey-Type: eddsa
Subkey-Curve: ed25519
Name-Real: CI Build System
Name-Email: ci-signing@company.com
Expire-Date: 1y
%no-protection
EOF

# Export public key for distribution
gpg --armor --export ci-signing@company.com > signing-key.pub

# Export private key for CI/CD (store in secrets manager)
gpg --armor --export-secret-keys ci-signing@company.com > signing-key.priv
Step 2: Sign Build Artifacts in CI/CD
yaml
# .github/workflows/build-sign.yml
name: Build and Sign

on:
  push:
    tags: ['v*']

jobs:
  build-sign:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write  # For Sigstore keyless signing
    steps:
      - uses: actions/checkout@v4

      - name: Build artifacts
        run: |
          make build
          sha256sum dist/* > dist/checksums.sha256

      - name: Import GPG Key
        run: |
          echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --batch --import
          gpg --list-secret-keys

      - name: Sign artifacts
        run: |
          for file in dist/*; do
            gpg --detach-sign --armor --local-user ci-signing@company.com "$file"
          done

      - name: Install cosign for keyless signing
        uses: sigstore/cosign-installer@v3

      - name: Keyless sign with Sigstore
        run: |
          for file in dist/*.tar.gz; do
            cosign sign-blob "$file" \
              --output-signature "${file}.sig" \
              --output-certificate "${file}.cert" \
              --yes
          done

      - name: Create Release with signed artifacts
        uses: softprops/action-gh-release@v2
        with:
          files: |
            dist/*
            dist/*.asc
            dist/*.sig
            dist/*.cert
Step 3: Verify Signatures in Deployment Pipeline
bash
# Verify GPG signature
gpg --import signing-key.pub
gpg --verify artifact.tar.gz.asc artifact.tar.gz

# Verify Sigstore keyless signature
cosign verify-blob artifact.tar.gz \
  --signature artifact.tar.gz.sig \
  --certificate artifact.tar.gz.cert \
  --certificate-identity ci-signing@company.com \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# Verify checksums
sha256sum --check checksums.sha256
Step 4: Sign npm Packages with Provenance
json
{
  "scripts": {
    "prepublishOnly": "npm run build && npm run test"
  },
  "publishConfig": {
    "provenance": true
  }
}
bash
# Publish npm package with provenance attestation
npm publish --provenance

Key Concepts

TermDefinition
Code SigningCryptographic process of signing software artifacts to verify publisher identity and artifact integrity
Detached SignatureSignature stored in a separate file from the artifact, allowing independent distribution
Keyless SigningSigstore's approach using short-lived certificates tied to OIDC identities instead of long-lived keys
ProvenanceMetadata describing how, where, and by whom an artifact was built
Transparency LogAppend-only log (Rekor) that records all signing events for public auditability
Trust ChainHierarchical chain from root CA to signing certificate establishing trust in the signer's identity
SLSASupply-chain Levels for Software Artifacts — framework defining levels of supply chain security
Show full SKILL.md (178 more words)Show less

Tools & Systems

  • GPG/PGP: Traditional asymmetric cryptography tool for signing and verifying artifacts
  • Sigstore (cosign): Modern keyless signing infrastructure using OIDC identity and transparency logs
  • Rekor: Sigstore's transparency log recording all signing events immutably
  • Fulcio: Sigstore's certificate authority issuing short-lived certificates bound to OIDC identities
  • notation: Microsoft's artifact signing tool for OCI registries (Project Notary v2)

Common Scenarios

Scenario: Establishing Signed Release Pipeline

Context: An open-source project needs to sign release artifacts so users can verify authenticity and detect tampering.

Approach:

  1. Use Sigstore keyless signing in GitHub Actions (no key management overhead)
  2. Sign all release binaries with cosign sign-blob using OIDC identity
  3. Generate and sign checksums file for bulk verification
  4. Upload signatures, certificates, and checksums alongside release artifacts
  5. Document verification instructions in the project README
  6. Add verification step to the Homebrew formula or apt repository

Pitfalls: GPG key compromise requires revoking and re-signing all artifacts. Sigstore keyless signing avoids this by using ephemeral keys. Long-lived signing keys in CI/CD secrets are a supply chain risk if the CI system is compromised.

Output Format

Artifact Signing Report
========================
Pipeline: Build and Sign v2.3.0
Date: 2026-02-23
Signing Method: Sigstore Keyless + GPG

SIGNED ARTIFACTS:
  app-v2.3.0-linux-amd64.tar.gz
    GPG:      PASS (ci-signing@company.com, EdDSA/Ed25519)
    Sigstore: PASS (Rekor entry: 24658135, Fulcio cert issued)
    SHA256:   a1b2c3d4...

  app-v2.3.0-darwin-arm64.tar.gz
    GPG:      PASS
    Sigstore: PASS (Rekor entry: 24658136)
    SHA256:   e5f6g7h8...

  checksums.sha256
    GPG:      PASS (detached signature)

TRANSPARENCY LOG:
  Entries recorded: 3
  Log index range: 24658135-24658137
  Verification: https://search.sigstore.dev

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 7 other files (scripts, references, assets) in skills/implementing-code-signing-for-artifacts of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Implementing Code Signing For Artifacts next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Implementing Code Signing For Artifacts compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Implementing Code Signing For Artifacts this skillmukul975/Anthropic-Cybersecurity-Skills34k—~1.8kAutomated safety check: PassApache-2.0
Releaselinagora/twake-on-matrix168—~1kAutomated safety check: PassAGPL-3.0
Electron Wrapperbrianlovin/agent-config376—~2.3kAutomated safety check: PassNone
Releasevaayne/mori303—~1.2kAutomated safety check: PassMIT
Deploy Androidtimusus/Shuttle2229—~1.2kAutomated safety check: PassApache-2.0
Electron Releasepedronauck/skills634—~1.6kAutomated safety check: NotesNone

Similar skills

  • Release

    linagora/twake-on-matrix

    Twake-on-Matrix release process skill. An agent skill from linagora/twake-on-matrix.

    168 GitHub stars~1k tokensUpdated today
    MobileAuto-check passed

  • Electron Wrapper

    brianlovin/agent-config

    Wrap a Bun web app into an Electron desktop app with native window management, auto-updates, code signing, and CI/CD distribution.

    376 GitHub stars~2.3k tokensUpdated 6 mo ago
    MobileAuto-check passed

  • Release

    vaayne/mori

    Release workflow for Mori macOS workspace terminal and MoriRemote iOS app.

    303 GitHub stars~1.2k tokensUpdated 2 mo ago
    MobileAuto-check passed

  • Deploy Android

    timusus/Shuttle2

    Deploy the Android app to the Play Store via GitHub Actions.

    229 GitHub stars~1.2k tokensUpdated today
    MobileAuto-check passed

  • Electron Release

    pedronauck/skills

    Expert guide for Electron production builds, code signing, notarization, auto-updates, and release workflows.

    634 GitHub stars~1.6k tokensUpdated 23 days ago
    MobileAuto-check: notes

  • Wjs Auditing Project

    jianshuo/claude-skills

    A skill your agent uses when the user asks to audit what's wrong with a project, "make it right", "看看项目出了什么问题", "为什么用户的需求还没上线", "为什么没提交App Store", "为什么没新build", or wants a holistic…

    130 GitHub stars~2.5k tokensUpdated 1 mo ago
    MobileAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 637 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Categories

Questions about Implementing Code Signing For Artifacts

What does Implementing Code Signing For Artifacts do?

Implements code signing for build artifacts (binaries, packages, containers) using GPG, Sigstore, and platform-specific signing tools, establishing trust chains and verifying signatures in…. Implementing Code Signing For Artifacts is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Implements code signing for build artifacts (binaries, packages, containers) using GPG, Sigstore, and platform-specific signing tools, establishing trust chains and verifying signatures in deployment pipelines.

When should I use Implementing Code Signing For Artifacts?

Implementing Code Signing For Artifacts fits situations like: establishing artifact integrity checks against supply-chain tampering; proving authenticity to customers; building zero-trust pipelines that reject unsigned artifacts; meeting SLSA Level 2+ provenance requirements.

How do I install Implementing Code Signing For Artifacts in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-code-signing-for-artifacts -a claude-code`. Or copy the skill folder (skills/implementing-code-signing-for-artifacts in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/implementing-code-signing-for-artifacts in your project. Claude Code loads it when a task matches its description.

How do I install Implementing Code Signing For Artifacts in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-code-signing-for-artifacts -a codex`. Or copy the skill folder (skills/implementing-code-signing-for-artifacts in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/implementing-code-signing-for-artifacts in your project. Codex loads it when a task matches its description.

Can I use Implementing Code Signing For Artifacts in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-code-signing-for-artifacts -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/implementing-code-signing-for-artifacts, .gemini/skills/implementing-code-signing-for-artifacts, .github/skills/implementing-code-signing-for-artifacts and .opencode/skills/implementing-code-signing-for-artifacts in your project.

What does Implementing Code Signing For Artifacts need to run?

Going by SKILL.md and its folder, Implementing Code Signing For Artifacts needs Python for the scripts in its folder, the command-line tools its instructions call (npm) and credentials named GPG_PRIVATE_KEY. Our summary lists: Python 3; A credential in GPG_PRIVATE_KEY.

Does Implementing Code Signing For Artifacts access the network?

SKILL.md names 2 domains. In commands or code: token.actions.githubusercontent.com and search.sigstore.dev; the agent is likely to contact these when it follows the instructions. This is read from the text; nothing was executed.

Is Implementing Code Signing For Artifacts safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Implementing Code Signing For Artifacts use?

Implementing Code Signing For Artifacts is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Implementing Code Signing For Artifacts use?

About 1.8k tokens (SKILL.md is roughly 7.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 1.3k tokens, read only when the agent opens those files.

What are the alternatives to Implementing Code Signing For Artifacts?

Skills that share tags, products or a category with Implementing Code Signing For Artifacts: Release (linagora/twake-on-matrix, 168 stars), Electron Wrapper (brianlovin/agent-config, 376 stars), Release (vaayne/mori, 303 stars) and Deploy Android (timusus/Shuttle2, 229 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Implementing Code Signing For Artifacts?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 33,922 GitHub stars. The repository holds 637 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.