{
  "spec": "sak-package-signature/v1",
  "algorithm": "ed25519",
  "sha256": "083c3432e1a35d1b32362bb159948cd7e13ceedc4d695fe730159bae6d84eedd",
  "signature": "js23tQtmTm75p4JjGiVky3p6tusk//4dk73DPa7b4NPDKM9GN3oiH8wW69mV+oUEVnqmGld0XNKxau5a4vQLBA==",
  "signing_key_id": "0aff169ecb84607d",
  "signed_at": "2026-11-01T17:59:42.937Z",
  "slug": "supplier-risk-evidence",
  "version": "0.1.4",
  "filename": "supplier-risk-evidence-agent-plugin.zip",
  "bytes": 59801,
  "content_digest": "826349d2c394b7936fddf7401f0a45e31bfb88bb8c6fac811d73690e7445d4c9",
  "content_signature": "JwknC6X7Zzl5XP7jEqmcFJliyglNmwC7w97PzJ9KFsM4q3sAIr11I+qRis2S8+IcQdW6s53FQ8TPPF+YD7cmDw==",
  "files": [
    {
      "path": "plugin.json",
      "sha256": "8f41bddb8ff91bf63326f0c51ac5a745dfb78f1868eba8029bcd6e92a0b49d41"
    },
    {
      "path": "skills/supplier-risk-evidence/SKILL.md",
      "sha256": "4f3c7c2256beafba21d6b84b83f8220e63e75f9e16642e3a2a80ddae7e127bd8"
    },
    {
      "path": "skills/supplier-risk-evidence/references/contract.json",
      "sha256": "be04968b7f527630ec3f1e91383d9828ba480611e3903c8911acdc337d7978f7"
    },
    {
      "path": "skills/supplier-risk-evidence/references/model-profile.json",
      "sha256": "2812933586c6ae70ba56d869b3d6b05e2836b4f80c8845e9b86ae7ef3b951b78"
    },
    {
      "path": "skills/supplier-risk-evidence/references/system-prompt.txt",
      "sha256": "9125b9b602cd438204a562b64bb5829c55e33e9be4a6cccbf15fbc70fbf6e4d4"
    },
    {
      "path": "skills/supplier-risk-evidence/scripts/check_input.py",
      "sha256": "b7043b2eb7b7a407ec68d12253d6f9b75b72d254e5eff80d66879c5905a94260"
    },
    {
      "path": "skills/supplier-risk-evidence/scripts/local_runtime.py",
      "sha256": "9fda01b2205de3b0e0b1888ab9b2b83e4b318898fa4ed8e37aa22f9f5fa9ba31"
    },
    {
      "path": "skills/supplier-risk-evidence/scripts/run_request.py",
      "sha256": "a5bd9fb046af144f3eaae011f45ba709f9b4f0d41a7b1d3ceffc42138ae9cb96"
    },
    {
      "path": "skills/supplier-risk-evidence/tests/input.json",
      "sha256": "525ee0c8cd710c72c3413af91b2b8769502f7e6ffdd58fa85f7cfb3d02795369"
    }
  ],
  "verify": {
    "public_key_url": "https://superagentskill.com/api/public/signing-key.pem",
    "instructions": "sha256 the downloaded .zip, compare with `sha256`, then verify the base64 `signature` as an Ed25519 signature over the ascii sha256 hex string using the public key. An extracted or repacked copy can still be verified via `content_digest` / `content_signature`. Helper: node scripts/verify-package-signature.mjs <file.zip> <signature.json> [public-key.pem]"
  }
}