{
  "spec": "sak-package-signature/v1",
  "algorithm": "ed25519",
  "sha256": "5a6d310f317a3b3736fb57f9dda94027c6f6208c0577c64d41904911a1c79129",
  "signature": "/SxGVbZz7w1b8C3XLm8Ixr9nkQH/aBUhXBwIG8DlGRfqwqqLhCCclEAxffVSrXQi4myTFU2pceKatiVYmy1yDw==",
  "signing_key_id": "0aff169ecb84607d",
  "signed_at": "2026-11-01T17:59:53.055Z",
  "slug": "mcp-tool-poisoning-auditor",
  "version": "0.1.4",
  "filename": "mcp-tool-poisoning-auditor-agent-plugin.zip",
  "bytes": 59379,
  "content_digest": "3bb55060bdd32384085cea2be93d80e778e4b7fbe891d6e355b0ff87538a796a",
  "content_signature": "agDx7bPqJQx0drnFEIJ9Rg1gaRfnmvLKSR3NA3IEgs4ghD9dvCjmiUNmDZ0F+yYbBqDHs3UYm0jABITMyWC2DQ==",
  "files": [
    {
      "path": "plugin.json",
      "sha256": "dd59e945ad5adef8c47c1fb39cedf9514881ff2e8ec2186cc13b4465df759174"
    },
    {
      "path": "skills/mcp-tool-poisoning-auditor/SKILL.md",
      "sha256": "d70ea62cf9a577a473c033e1a5d74cc98dfb4586df38e51dc1e86dc48a00c6dc"
    },
    {
      "path": "skills/mcp-tool-poisoning-auditor/references/contract.json",
      "sha256": "b7b84d5acc1619b0647ad8af2d6ccb77187fc454939b0ecc2d875632b034976d"
    },
    {
      "path": "skills/mcp-tool-poisoning-auditor/references/model-profile.json",
      "sha256": "b57b64495b60864cd3cc188813044bf28f7478c089ad6a68bb8bc0d3621c3730"
    },
    {
      "path": "skills/mcp-tool-poisoning-auditor/references/system-prompt.txt",
      "sha256": "e80ced9c9ad73040ef326811daa62780699c075205903c031742ab27cf576472"
    },
    {
      "path": "skills/mcp-tool-poisoning-auditor/scripts/check_input.py",
      "sha256": "b7043b2eb7b7a407ec68d12253d6f9b75b72d254e5eff80d66879c5905a94260"
    },
    {
      "path": "skills/mcp-tool-poisoning-auditor/scripts/local_runtime.py",
      "sha256": "9fda01b2205de3b0e0b1888ab9b2b83e4b318898fa4ed8e37aa22f9f5fa9ba31"
    },
    {
      "path": "skills/mcp-tool-poisoning-auditor/scripts/run_request.py",
      "sha256": "a5bd9fb046af144f3eaae011f45ba709f9b4f0d41a7b1d3ceffc42138ae9cb96"
    },
    {
      "path": "skills/mcp-tool-poisoning-auditor/tests/input.json",
      "sha256": "3fc8a23cafa596289e3071ce0bf778222a1153c56e13eb95e5802bd5d4b1d3af"
    }
  ],
  "verify": {
    "public_key_url": "https://superagentskill.com/api/public/signing-key.pem",
    "instructions": "sha256 the downloaded .zip, compare with `sha256`, then verify the base64 `signature` as an Ed25519 signature over the ascii sha256 hex string using the public key. An extracted or repacked copy can still be verified via `content_digest` / `content_signature`. Helper: node scripts/verify-package-signature.mjs <file.zip> <signature.json> [public-key.pem]"
  }
}