{
  "spec": "sak-package-signature/v1",
  "algorithm": "ed25519",
  "sha256": "65968d3321c9fed6545a7baf03687f2cce5230c24f24e269b37d71b171ae2e82",
  "signature": "VW7NXaaWe3MmAyvAHjS4lGuYlhOV68cAb4xR1tvqudxP5cGexstnc80GXqpiWue5upfp8oWcKy9d9dDqu747Ag==",
  "signing_key_id": "0aff169ecb84607d",
  "signed_at": "2026-08-24T00:49:12.851Z",
  "slug": "dep-cve-watcher",
  "version": "0.1.0",
  "filename": "dep-cve-watcher-agent-plugin.zip",
  "bytes": 3393,
  "content_digest": "cdbe07da2ee1e51cc3388cf5b43c01726e99e454496e2b996a806f269bad7cd6",
  "content_signature": "/cOIEoGZWOA3nm6nuguN89DNbVGbbPYfpFfiW1NmxypI5KqghxlNVzGBez65NRfKXGzxoMKd311C5qLw29t7Dg==",
  "files": [
    {
      "path": "mcp.json",
      "sha256": "a4ec0149cccb566b6c4b6d8413290229819ff2adcfa9eb5387c3f91d31103a57"
    },
    {
      "path": "plugin.json",
      "sha256": "5aeccd7886f253ee8143b5124aa506e279e8b30d9f18276e23f81df42c3ff328"
    },
    {
      "path": "skills/dep-cve-watcher/SKILL.md",
      "sha256": "efe541a489acb9b27862aa3e920a7f4b7baf536385830e33c05ce42d114d4ce2"
    }
  ],
  "verify": {
    "public_key_url": "https://superagentskill.com/api/public/signing-key.pem",
    "instructions": "sha256 the downloaded .zip, compare with `sha256`, then verify the base64 `signature` as an Ed25519 signature over the ascii sha256 hex string using the public key. An extracted or repacked copy can still be verified via `content_digest` / `content_signature`. Helper: node scripts/verify-package-signature.mjs <file.zip> <signature.json> [public-key.pem]"
  }
}