Don't rely on the page
Verify on your own machine.
Check any folder against its certificate. It prints VERIFIED or explains why not.
npx @workrr-trust/certify verify <folder> --bundle <certificate.json> --source <owner/repo>Product · skills.workrr.ai · Public preview
Find agent skills you can verify.
Skills is the workrr trust directory of skills, MCP servers, and agent files. Every entry shows what was checked, by whom, and at which commit, and links to its source on GitHub. workrr never hosts the artifacts. It points to them, with the evidence.
- Skills, MCP servers, agent filesSearch by category, trust level, and the agents each one works with.
- Exact commitEvery entry links to its source on GitHub at the commit that was checked.
- Not hostedworkrr never copies or hosts listed artifacts. You install from the source.
- Ready-made promptCopy a prompt for your coding agent that pins the commit and verifies the certificate before use.
- Public ledgerEvery certificate is also listed in the workrr trust public ledger.
- Quality gradeAn A–E band scores scan warnings, declared allowed-tools, structured docs, and a license.
What each level means.
Levels are named for how much scrutiny an artifact has had, from least to most. A level means it passed these checks, nothing more.
- Scannedworkrr read a public commit and the checks passed: provenance, policy, and a known-pattern scan.
- SignedThe maintainer's own CI ran the open certifier and signed the result through Sigstore, recorded in the public Rekor log.
- TestedSigned, and the artifact's own test suite passed in a job that cannot sign.
- ReproducedTwo independent forges certified the same digest.
Flagged: a signed, reproducible finding on the newest commit, down to the rule, file, and line. No copy or install option is offered until it is fixed.
For publishers
Get your skill to Signed.
Add the open certifier to your repository's CI. Each release is signed through Sigstore and appears in the directory with its level.
Choosing skills for your team's agents?
We help your team pick, verify, and gate the skills and MCP servers your agents load, with a private registry in your own CI.