Skip to content

Cryptographically Signed Skill Registry

ctxsec features a zero-trust package manager and registry client for agent capabilities, tools, and policy modules.

Zero-Trust Cryptographic Verification

Unlike traditional package managers that allow arbitrary code uploads, every skill published to the ctxsec registry must be:

  1. Statically Audited: Pure Go or declared tool schemas with zero unreviewed CGo or binary blobs.
  2. Ed25519 Signed: Manifests and code hashes are cryptographically signed with the author's private key.
  3. Locally Verified: The ctx registry install command computes the SHA256 digest of downloaded packages and verifies the signature against the publisher's public key before installation.

Registry Commands

Search for Skills

ctx registry search "tokens"

Install and Verify

ctx registry install ctxsec/context-optimizer

Output: 

🔍 Resolving ctxsec/context-optimizer@1.0.0...
📥 Downloading package manifest...
🔐 Verifying Ed25519 signature (fingerprint: ed25519:7a4f...e89b)...
✅ Signature OK. Cryptographic integrity confirmed.
📦 Installed to .agents/skills/context-optimizer

Verify an Existing Skill

ctx registry verify .agents/skills/context-optimizer