Agent skills directory
Skills, MCP servers and agent files, with the evidence
Every entry shows its workrr trust level and links to its source on GitHub at the exact commit. workrr never hosts them. Copy a ready-made prompt for your coding agent; it pins the commit and verifies the certificate before use. What the levels mean.
Loading the directory…
How to read this
What each level means
workrr trust is a watchdog: it records what was checked, by whom, at which commit. Levels are named for how much scrutiny an artifact has had, from least to most. A level means "passed these checks", nothing more. The A–E band next to Scanned and Signed is a quality grade: one point each for no scan warnings, declared allowed-tools, structured docs and a licence.
- Scanned
workrr read a public commit and the checks passed (provenance, policy, known-pattern scan). Reproducible by anyone, but not signed by the maintainer.
- Signed
The maintainer's own CI ran the open certifier and signed the result through Sigstore, recorded in the public Rekor log.
- Tested
Signed, and the artifact's own test suite passed in a job that cannot sign.
- Reproduced
Two independent forges certified the same digest.
- Flagged
A signed, reproducible finding for the newest commit: rule, file and line. No copy or install option is offered. Fixed code is re-scanned automatically within about a day.
Don't rely on this page. Verify any folder against its certificate on your own machine; it prints VERIFIED or explains why not:
npx @workrr-trust/certify verify <folder> --bundle <certificate.json> --source <owner/repo>Every certificate is in the public ledger. The layout rules and levels are in the layout standard. Think a finding is wrong? Open an issue.