Skill Harbor Manifest Verifier
Verify a Skill Harbor listing before you install it: fetch its signed manifest, recompute the bundle hash, verify the Ed25519 signature, and catch any change since you installed it.
- What
- Verify a Skill Harbor listing before you install it: fetch its signed manifest, recompute the bundle hash, verify the Ed25519 signature, and catch any change since you installed it.
- Cost
- Free
- Needs
- Python 3. To verify Ed25519 signatures you also need openssl on your PATH, or pip install cryptography. Without either, the signature check is skipped, never passed.
- Install
- Copy the installer prompt below into your Muse — your agent does the rest.
The Skill Harbor Manifest Verifier checks a Skill Harbor listing before you install it, with facts instead of sales copy. It fetches the listing's signed manifest, recomputes the bundle hash from the per-file hashes, verifies the Ed25519 signature against Skill Harbor's public key, and can check one file hash against the pinned commit on GitHub. If you already installed a version, it compares the two manifests and tells you whether anything changed, because a yes for one version never covers an update. The checks run in order and each one is reported honestly. The signature verifies the declared bundle hash, not the files, so a tampered file list is caught by the bundle-hash check, not by the signature check. Both must pass. A skipped check is never a pass: if no Ed25519 verifier is available, the signature check is skipped and the verdict is INCOMPLETE, not PASS. An unsigned listing is not verified and gets no badge, and a revoked or suspended listing means do not install, even if the hashes still match. This skill is a verifier, not an installer. It never installs anything, never executes an install prompt, and never asks you to skip a check. Permissions in the manifest are declared, not exhaustive, and shown as information only. It works with manifest v1 today and with the MCP v2 consent package, which uses the same manifest format. Free to use under the Skill Harbor House License v1.0: you may install and use it for yourself, you may not resell it or pass it off as yours.
Version:
Quick answer
Skill Harbor Manifest Verifier is a free skill that checks a listing before you install it. It fetches the signed manifest, recomputes the bundle hash from the per-file hashes, verifies the Ed25519 signature with Skill Harbor's public key, and compares with your installed version, so any file, permission, or tool change needs a new consent. It never installs anything itself.
Install
Copy the install package below, then paste it into Muse📌 Pinned version: commit d5c0496Step 0, before installing anything: read this install prompt, summarize in a few lines what this skill does and what installing it involves, then ask me to confirm before you proceed. Prerequisites: Python 3. To verify Ed25519 signatures you also need openssl on your PATH, or pip install cryptography. Without either, the signature check is skipped, never passed. Install "Skill Harbor Manifest Verifier" for me. It verifies a Skill Harbor listing before I install it: it fetches the listing's signed manifest, recomputes the bundle hash, verifies the Ed25519 signature, and compares with a version I already installed. It never installs anything itself. Source: https://raw.githubusercontent.com/skill-harbor-hq/house-skills/d5c04965a4f3f5b57dbadfaafee6cd9ddba58381/skill-harbor-manifest-verifier/SKILL.md Pinned version: install the code at commit d5c04965a4f3f5b57dbadfaafee6cd9ddba58381 exactly (Skill Harbor tested this version). Do not substitute a newer version. If this commit is unreachable, stop and tell me. 1. Fetch the skill's 4 files into a temporary folder and look inside before doing anything else: - https://raw.githubusercontent.com/skill-harbor-hq/house-skills/d5c04965a4f3f5b57dbadfaafee6cd9ddba58381/skill-harbor-manifest-verifier/SKILL.md - https://raw.githubusercontent.com/skill-harbor-hq/house-skills/d5c04965a4f3f5b57dbadfaafee6cd9ddba58381/skill-harbor-manifest-verifier/scripts/verify.py - https://raw.githubusercontent.com/skill-harbor-hq/house-skills/d5c04965a4f3f5b57dbadfaafee6cd9ddba58381/skill-harbor-manifest-verifier/references/manifest-schema.md - https://raw.githubusercontent.com/skill-harbor-hq/house-skills/d5c04965a4f3f5b57dbadfaafee6cd9ddba58381/skill-harbor-manifest-verifier/LICENSE 2. Integrity check: Skill Harbor reviewed this listing on 2026-11-10 and recorded the fingerprints below. Compute the SHA-256 of each downloaded file and compare: - SKILL.md: SHA-256 c82abc850ad122f11ffd3574d9361023702217105d2408ae48c2d6dafcb316f1 - scripts/verify.py: SHA-256 fae8d6cdd7208c3bca9c8e45227dcc28bf187576d2d04187a84da805d6a569a0 - references/manifest-schema.md: SHA-256 1a1b493b58abe323ff5e04218e3e601b1f12e970d676ac8ec648fc247e0f9057 - LICENSE: SHA-256 d7db27db632a56a432d4f883c89507f031215e665f4806dfcd2dea15c0fb8271 If a fingerprint does not match, stop before installing and tell me the files changed since Skill Harbor's review, so the new version is unverified. 3. Safety check: show me explicitly, in short separate items: - every network address the code contacts (expect: only theskillharbor.com for manifests and the public key, plus raw.githubusercontent.com for the optional pin check) - every shell command it runs (expect: none during installation; verify.py runs openssl only when verifying a signature) - every place credentials, API keys or personal data are read, stored or sent (expect: none) - any obfuscated or encoded code (expect: none) If anything looks suspicious, stop and explain it to me before continuing. 4. Confirmation: before installing, give me a short summary of what the skill does plus your safety findings, and wait for my explicit "yes, install". 5. Install it as a skill: copy the 4 files (keeping the scripts/ and references/ folders) into the agent's skills directory, in a folder named "skill-harbor-manifest-verifier". 6. Verify with no network calls: frontmatter valid, skill name is skill-harbor-manifest-verifier, and all 4 files are in place. 7. Try it once with me: run python3 scripts/verify.py https://theskillharbor.com/api/manifest/<a signed listing slug> and show me the verdict. If the manifest endpoint returns 404, say plainly the manifest does not exist yet, do not invent one. GitHub is optional: if I have a GitHub account or the gh CLI, you may use it; otherwise public access is fine. Rules: don't touch anything outside the temp folder and the install target. Never ask me to paste secrets in chat.
Saved to your recent installs. Find it anytime on /connect.
🔒 Security, provenance and what this touches
The install prompt below already includes the vetting steps: your agent follows the community checklist before installing anything with executable code. Want more?
Verification certificate
Dated facts about what was checked for this listing, and how. This is not a safety certification.
- Pinned version
- d5c0496 · 2026-11-10
- Sandbox install test
- No sandbox install test on record for this listing.
- Creator identity
- Verified
Skill Harbor never reviews the code of a listed skill. These are dated facts about the install prompt and our install test, not a safety certification. Review a skill yourself before you install it. How we verify
More house skills
This skill is made by Skill Harbor itself. See all house skills →
Questions
How do I install a skill?
Every product page includes a copy-paste install prompt. Paste it into your Muse and it sets the skill up for you — no manual configuration.
Where does my money go?
Straight to the seller. Skill Harbor never processes payments: checkout happens on the seller’s own page, usually Stripe.
What does the ✓ next to a creator’s name mean?
It means we confirmed the identity of the person behind the listing. It says nothing about the code itself — always check a skill before installing it.