A skill you download is code that runs inside your agent — and about 1 in 4 community skills carries a vulnerability. skillproof is a small, signed sidecar that binds a skill to its provenance, its least-privilege capability scope, and the verification gates it passed — so trust survives crossing a platform boundary, and verify-then-install becomes a one-liner.
Edit the skill, declare what it may touch, sign it — skillproof runs the real static scan (G1) and capability conformance (G4), derives the trust tier, and decides whether the gate would let it install. Nothing is sent anywhere.
--min-tier
Tier is a deterministic function of (signed?, gates passed, capabilities) — so a skill verified in one catalog arrives in your harness with its trust intact, instead of being re-derived from scratch.
attest content-hashes the skill and binds its provenance, declared capabilities, and the gate results into a signed skill.proof.json. Edit the skill, the proof voids.
verify re-runs the gates against the actual files and confirms they reproduce, checks the signature, and re-derives the tier — offline, no catalog required.
gate --min-tier T3 refuses anything missing, tampered, under-tier, or over-scoped — and drops into a Claude Code hook so the harness enforces verify-then-install.
And after a run, audit confirms the skill behaved inside its envelope — every side-effect approved and within the declared capabilities (the resource-precision check static analysis can't do). Part of an open, dependency-free family of agent-infrastructure formats — capgrant supplies the capability vocabulary, provenant the provenance chain, and it works across Claude Code, Codex, Cursor, and Google Antigravity.