TrustView
Pin Digest
skillerr/pin-digest
Submitted by @rift_io · Rift IO
Jul 11, 2026 · minted Jul 14, 2026
sha256:5276354b675a…Skill Score
85/ 100 · Strong seal
Skill Score is actively being developed and will get sharper over time.
- Sealed package20/20
Minted .skill blob in the registry
- Digest published15/15
sha256 pin published on skillerr.com
- Permissions declared15/15
Capabilities / permissions declared
- Source attested10/10
Namespace, submitter, or source URL (not a vendor endorsement)
- Transparency log0/15
Not anchored
- Release profile15/15
evaluateReleaseProfile passed
- Registry signal5/5
1980 install(s) on registry
- Not revoked5/5
No revocation on log
Not a malware scan. Not “safe to run.” Transparent registry signals only. Inclusion is not endorsement.
Install
npx @skillerr/add skillerr/pin-digestRegistry pin: sha256:5276354b675a… (shown on TrustView; install by name resolves to this sealed blob)
Sealed install targets
Writes pin-digest.skill (sealed ZIP) plus optional skillerr.json. Not a bare SKILL.md.
Sealed ZIP with digest + skillerr.json. Not a bare SKILL.md.
Free skills install with npx @skillerr/add. Sign in for account history.
Sealed artifact
Install and download deliver a digest-pinned open .skill package (docs.skillerr.com). Pasting a SKILL.md from the internet has none of this proof.
- ✓
pin-digest.skill ZIP
Open-protocol .skill ZIP (skill.json + workflow), not a public raw SKILL.md URL
- ✓
Registry digest pin
sha256:5276354b675a…
- ✓
Inspect before run
TrustView on skillerr.com; SKILL.md is a lossy adapter inside the package
- ✓
Permissions surface
Capabilities declared for review before install
- ✓
Transparency log
Inclusion proof in the skillerr.com registry log
Permissions map
Read or write files in the workspace
Declarations for humans and agents. Not a runtime sandbox guarantee.
Integrity verify
Confirm the digest on this page matches the live registry. This checks identity pins only: not a security scan.
expect sha256:5276354b675adda3…npx @skillerr/add info skillerr/pin-digestcurl -sS https://skillerr.com/api/v1/skills/skillerr/pin-digest | grep -o '"digest":"[^"]*"'Summary
Pin and verify package digests in a project so installs cannot silently float.
Description
Write digest pins into your project lockfile (skillerr.lock) and verify installed packages match expected sha256 digests. Tags float deliberately; digests do not. Essential for CI and org-ready agent setups that need reproducible skill installs.
Inspect package contentsSKILL.md inside .skill
TrustView preview on skillerr.com. Install and download serve the sealed package: there is no public raw SKILL.md URL.
--- name: pin-digest title: Pin Digest description: Pin and verify package digests in a project so installs cannot silently float. --- # Pin Digest Pin and verify package digests in a project so installs cannot silently float. ## Description Write digest pins into your project lockfile (skillerr.lock) and verify installed packages match expected sha256 digests. Tags float deliberately; digests do not. Essential for CI and org-ready agent setups that need reproducible skill installs. ## Capabilities - fs
Verified
- Public Ledger
- Not anchored
Transparency
- published_at
- 2026-02-10T11:00:00.000Z
- version
- 0.1.0
- updated_at
- 2026-06-15T08:30:00.000Z
- license
- MIT
- minted_at
- 2026-07-14T15:03:57.000Z
- permanence
- in registry log
- digest
- sha256:5276354b675adda30e9dc911a2b059a3e8d4c9487e450ecd95342b32fa6f16c5
Public permanence uses Sigstore Rekor. The ledger link is shown when a real logIndex was recorded at mint. Green Anchored requires an offline inclusion proof verify. Catalog claims alone never paint Anchored. Inclusion is not endorsement.