# Mkit Attest

> >

- **Type:** Skill
- **Install:** `agentstack add skill-officialunofficial-skills-mkit-attest`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [officialunofficial](https://agentstack.voostack.com/s/officialunofficial)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [officialunofficial](https://github.com/officialunofficial)
- **Source:** https://github.com/officialunofficial/skills/tree/main/skills/mkit/mkit-attest

## Install

```sh
agentstack add skill-officialunofficial-skills-mkit-attest
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# mkit-attest

An mkit **attestation** is an in-toto v1 Statement (a typed predicate about a
subject) sealed in a **DSSE** envelope and attached to a commit. Downstream
consumers verify it against a **trust-roots registry** — the set of public keys
they're willing to trust. The subject is always a commit (its BLAKE3 id); the
predicate is your claim (provenance, code review, SBOM, test results, …).

The chain is: **signed commit → one or more DSSE attestations → verify against
trust roots**. A commit must already be signed (`mkit keygen` first); attestation
adds claims *on top* of the commit signature.

## Attestation signer keys

Attestation signers are **separate** from the Ed25519 commit key and are written
by `keygen --algorithm`:

```sh
mkit keygen --algorithm ed25519      # → .mkit/keys/ed25519.key
mkit keygen --algorithm p256         # → .mkit/keys/p256.key
mkit keygen --algorithm secp256k1    # → .mkit/keys/secp256k1.key
```

> These do **not** create a commit key. If `commit` then reports "no signing
> key", run plain `mkit keygen` for the Ed25519 commit key. Keep the two roles
> distinct in your head: one key signs the commit, another signs the attestation.

## Produce an attestation

```sh
# Attest HEAD (or --commit ) with a predicate document:
mkit attest --algorithm ed25519 \
            --predicate-type https://example.com/review/v1 \
            --predicate-file review.json

# Multiple co-signers — all-or-nothing (any signer failure aborts; no partial
# envelope is written). Multi-signer is shell-only:
mkit attest --algorithm ed25519 \
            --additional-signer "algorithm=p256,signer=repo-key" \
            --predicate-type https://example.com/provenance/v1 \
            --predicate-file provenance.json
```

The predicate file is your claim as JSON; `--predicate-type` is the URI that
tells a verifier how to interpret it. Omit both to attest the bare subject.

## Verify attestations

```sh
mkit verify-attest --commit  \
                   --trust-roots ~/.config/mkit/trust-roots.toml
```

**Security gate — always pass `--trust-roots` explicitly.** `verify-attest`
refuses an *in-repo* trust-roots file, because a hostile clone could ship its own
roots and make verification falsely print "ok". The default path is
`$XDG_CONFIG_HOME/mkit/trust-roots.toml`. Exit codes:

| Exit | Meaning |
|------|---------|
| `0`  | every attestation has ≥1 verified signature |
| `65` | at least one attestation failed verification |
| `1`  | the commit carries no attestations |

Branch on these codes, not on stderr text — `1` (nothing to verify) is a
different decision from `65` (present but invalid).

## Prefer MCP when available

Through the mkit MCP server (`mkit mcp --repository `), `mkit_attest` and
`mkit_verify_attest` are stricter and safer than the shell — use them for
single-signer flows:

- The `attest` predicate file **must resolve inside** the repo.
- The `verify_attest` trust-roots path **must resolve outside** it (in-repo roots
  always rejected — the hostile-clone defense).
- Signing is pinned to ed25519 with the repo key; ambient `attest.*` config never
  steers it.

Multi-signer and external-signer attestation (`--additional-signer`,
`--signer external`) are **shell-only** — the MCP tool is single-signer by design.

## In CI

- Generate or provision the attestation signer out of band; never commit private
  keys. In an agent/CI context, pass the predicate via `--predicate-file` (no
  interactive paths).
- Verify with a trust-roots file that lives **outside** the checked-out repo
  (e.g. a runner-level config path), so a malicious PR can't smuggle its own
  roots into the verification.
- Gate the pipeline on the exit code: treat `65` as failure, and decide
  deliberately whether `1` (no attestations) should block or pass.

For the wire format and predicate details, see `docs/specs/SPEC-ATTESTATIONS.md`
and `docs/specs/SPEC-SIGNING.md` (or `get_spec ATTESTATIONS` / `SIGNING` via the
mkit docs MCP).

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [officialunofficial](https://github.com/officialunofficial)
- **Source:** [officialunofficial/skills](https://github.com/officialunofficial/skills)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-officialunofficial-skills-mkit-attest
- Seller: https://agentstack.voostack.com/s/officialunofficial
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.