skillseal/skillseal

SkillSeal — Evidence-Based Skill Certification

SkillSeal is a trust system for AI agent skills based on verifiable evidence and cryptographic signatures — not reputation or marketing.

The problem it solves

Agent skills (packages of SKILL.md + scripts) are powerful — and dangerous:

• They can execute code.
• They can access the network, files, and environment.
• Today the market is a "wild west": many people publish skills with no guarantee they work or are safe.

SkillSeal answers, in a verifiable way:

"Was this skill actually tested, in an isolated environment, and did it pass structure, functionality, and security?"

Role of each file

1. seal.py — the evaluator

It does not certify. It produces evidence.

Flow:

• Structure — checks the skill is well-formed (SKILL.md with frontmatter, referenced scripts exist, etc.).
• Functional test — runs the skill for real inside a hardened Docker container:
  • no network
  • read-only filesystem
  • memory, CPU, and process limits
  • minimal capabilities
  • strace capturing syscalls
  • Each test has command (a list of arguments) and expect (what should appear in the output). No tests → no functional evidence → it fails.
• Static security — scans the code for risk patterns (eval, network, destructive, obfuscation, etc.), classified as info / warning / fail.
• Runtime security — analyzes the real strace telemetry:
  • tried to connect to the internet?
  • tried to write outside /tmp?
  • read sensitive files?
  • executed suspicious processes?

At the end it produces an evidence report (JSON) with:

• skill hash
• test-suite hash
• result of each layer
• final status: PASS, PASS_WITH_WARNINGS, FAIL, or ERROR

The report is the proof of what was observed.

2. certificates.py — the certifying authority

It does not re-evaluate. It signs the evidence.

Flow:

1. Receives the report from seal.py.
2. Validates the report is complete (schema 2) and that the result is PASS.
3. Confirms the skill hash in the report matches the current directory.
4. Requires all layers and the runtime to be PASS.
5. Rejects scan reports (no functional evidence).
6. Builds a canonical payload with:
   • short code (SKL-XXXX-XXXX-XX)
   • content hash
   • checks (layer results)
   • evidence (hashes, environment, scope)
7. Signs with Ed25519 (private key).
8. Stores in the catalog (certificates.json).

The real authority is not the catalog JSON — it is the cryptographic signature.

On verification:

• Recomputes the content hash.
• Validates the signature with the public key.
• Only then declares CERTIFIED.

If someone modifies the skill afterward, the hash changes and the certificate stops being valid.

The trust chain (full view)

Skill (code)
    │
    ▼
seal.py
  → runs in a sandbox
  → observes real behavior
  → produces an evidence report
    │
    ▼
certificates.py
  → only accepts if result == PASS
  → verifies the hash
  → signs the report
  → issues a certificate
    │
    ▼
Anyone
  → verifies signature + hash
  → trusts (or not) the certificate

Important separation:

This avoids mixing "evaluating" with "certifying".

What the system is NOT

• It is not a marketplace.
• It is not a "decorative badge".
• It does not guarantee a skill is perfect forever.
• It does not replace human review in ambiguous cases (PASS_WITH_WARNINGS).

It guarantees something more specific and useful:

"On this date, with this test suite, in this environment, the skill passed structure, functionality, and security — and that is signed."

In one sentence:

seal.py proves what the skill does and whether it is safe; certificates.py turns that proof into a cryptographically verifiable certificate.

Usage

Evaluate a skill

# Full evaluation (runs in Docker, requires a test suite)
python3 seal.py test ./my-skill --tests tests.json

# Human-readable report
python3 seal.py report ./my-skill --tests tests.json

# Machine-readable report (JSON, for certification)
python3 seal.py report ./my-skill --tests tests.json --json > report.json

# Static-only scan (structure + static security; NOT certifiable)
python3 seal.py scan ./my-skill

Issue and verify a certificate

# Issue a certificate from a PASS report (the recommended path)
python3 certificates.py issue --report report.json ./my-skill \
    --name "My Skill" --version 1.0.0 --author "Workloop"

# Verify by code, hash, or directory
python3 certificates.py verify SKL-XXXX-XXXX-XX
python3 certificates.py verify ./my-skill

# List issued certificates
python3 certificates.py list

Test suite format

Each test specifies an explicit command (list of arguments) and expect:

{
  "tests": [
    {
      "name": "basic input",
      "command": ["python3", "scripts/main.py"],
      "input": "hello",
      "expect": ["hello"]
    }
  ]
}

Project status

seal.py is a mature MVP evaluator and certificates.py a closed certifier with a verifiable trust chain. The report schema is versioned (schema_version), and the evaluator version is embedded in every report (seal_version) so certificates remain auditable over time.

Public API

SkillSeal exposes a public API (no auth required for GET endpoints) so anyone can verify certificates, fetch the report, or submit skills for certification programmatically — from scripts, CI/CD pipelines, n8n workflows, or other agents.

Base URL: https://skillseal.workloop.com.br

GET /api/verify?code=SKL-XXXX-XXXX-XX

Verify whether a certificate code is genuine. Returns the certificate details if certified.

curl "https://skillseal.workloop.com.br/api/verify?code=SKL-D266-F285-BC"

{
  "status": "CERTIFIED",
  "skill": "rag-engineer",
  "author": "Dan 02",
  "content_sha256": "38db355331ea...",
  "issued_at": "2026-08-10T18:45:47Z",
  "issuer": "SkillSeal Certification Authority",
  "checks": { "structure": {...}, "functional": {...}, "static_security": {...} },
  "signature": "hex-ed25519-signature..."
}

GET /api/report

Get the full certification report: summary counts, all certified skills (with download links), and submission history (approved / rejected / pending).

curl "https://skillseal.workloop.com.br/api/report"

{
  "gerado_em": "2026-08-10T19:44:20Z",
  "resumo": { "total_certificados": 34, "submissoes_aprovadas": 5, "submissoes_reprovadas": 4, "submissoes_pendentes": 0 },
  "skills_certificadas": [ { "code", "skill", "author", "download_url", ... } ],
  "submissoes": { "aprovadas": [...], "reprovadas": [...], "pendentes": [...] }
}

POST /submit

Submit a skill (.zip, .tar.gz, or single .md/.py/.sh/.js/.sql file) for certification. Evaluated in an isolated sandbox; verdict returned instantly.

curl -F "name=João" -F "email=j@j.com" -F "file=@minha-skill.zip" \
     "https://skillseal.workloop.com.br/submit"

Form fields (multipart/form-data): name (required), email, file (required, max 10MB), notes.

{
  "success": true,
  "skill_name": "rag-engineer",
  "skill_desc": "RAG system design & auditing",
  "veredito": "CERTIFICADO",
  "certificado": "SKL-D266-F285-BC",
  "status_certificado": "CERTIFIED",
  "detalhe": "..."
}

Verdicts: CERTIFICADO (passed), NAO_CERTIFICADO (failed), DUPLICADO (content already certified — copy of an existing skill), ERRO_*.

GET /health

curl "https://skillseal.workloop.com.br/health"
// { "status": "ok", "time": 1789234567 }

Notes

• Authentication: none required for GET endpoints; POST /submit is rate-limited.
• Format: all responses are JSON (Content-Type: application/json).
• Certificate proof: the SKL code is the proof of certification — anyone can verify it via /api/verify or the web UI.

Certified skills

The skills/ directory contains certified skills. Each one has a verified certificate (accessible via the site's /verify page with its SKL-XXXX-XXXX-XX code).

Original skills (by Workloop):

• PostgreSQL Doctor — query tuning & EXPLAIN analysis
• n8n Automation Agent — workflow validation & best practices
• RAG Engineer — RAG system design & auditing
• No-Code Builder — platform selection & architecture
• ClickUp Expert — workspace setup & optimization
• Obsidian Expert — second brain & vault auditing
• Todoist Productivity — task management & GTD
• Instagram Growth Agent — account growth & metrics audit
• Yampi E-commerce Agent — checkout, upsell & cart recovery
• Bitrix24 CRM Agent — sales pipeline & funnel automation
• AI Money Agent — AI income streams & monetization audit

Community skills (MIT/Apache-2.0, enhanced by SkillSeal):

• Pytest Testing Agent — fixtures, mocking & markers
• Playwright E2E Agent — browser test config & selectors
• GitHub PR Agent — pull request quality checklist
• TypeScript Agent — strict config & best practices
• React 19 Agent — React Compiler patterns
• Django REST Agent — DRF setup & viewsets
• LangChain Agent — RAG pipeline config audit
• Chroma DB Agent — vector store config
• FAISS Agent — similarity search index setup
• Whisper Agent — speech recognition config
• vLLM Agent — high-throughput LLM serving config
• LlamaIndex Agent — RAG data framework setup

The skills/ directory also includes community skills that were enhanced with executable audit scripts and passed the SkillSeal three-layer certification (structure, functional, security). Original authors are credited in each skill's frontmatter; enhancements are MIT/Apache-2.0 compatible.

Why this matters

• Authors: the seal increases downloads and trust → more revenue.
• Users: install proven skills, not just "seems fine".
• Ecosystem: raises the quality bar in a market flooded with junk.

Built by Workloop · skillseal.workloop.com.br