Not in the top 1,000 by GitHub stars
grcorsair/corsair
Compliance trust shouldn't require emailing PDFs and hoping nobody tampered with them. Corsair signs compliance findings as verifiable digital certificates that anyone can check with a standard JWT library.
History
Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.
View weekly changes
skills/corsair/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Instructions only → After Instructions only
7b6edea364d7 → 7b6edea364d7
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Instructions only
First observation → 7b6edea364d7
No earlier version was observed for comparison.
View on GitHubAdd to my skills
Verified commit 7b6edea364d7149b7a449a9f3e56abb52ae507b0
git clone --filter=blob:none --no-checkout https://github.com/grcorsair/corsair.git .hotskills/grcorsair-corsair && git -C .hotskills/grcorsair-corsair checkout --detach 7b6edea364d7149b7a449a9f3e56abb52ae507b0
# Copy each selected skill directory from .hotskills/grcorsair-corsair into .agents/skills/<skill-name>/16GitHub stars
1star in 7 days
1skill in this repository
0commits in 30 days
Heat
1.8- Star growth, last 7 daysNot available
- Star growth, last 24 hoursNot available
- Rank movement, last 7 daysNot available
- Commits, last 30 daysNot available
- Accounts asking about it through MCP, last 7 daysNot available
- Hot votes this weekNot available
Heat never changes the order by stars, and sponsorship never touches it. How heat works
Stars over time
30-day change not yet available: not enough history.
Individual skills in this repository
- corsair
skills/corsair
How it works
corsair
When your agent uses it
Cryptographic compliance verification. Sign security tool output into verifiable CPOEs (JWT-VC), verify vendor proofs via trust.txt, detect drift with diff, and assess third-party risk. Use when the user mentions compliance proofs, CPOE, trust.txt, SCITT, vendor assessment, GRC evidence, or compliance drift.
What it loads into context
Frontmatter
132 tokensAlways available to the agent
SKILL.md
3,205 tokensWhen the skill is activated
Reference documents
3,895 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Security Notes (Review-Focused)
- When To Use
- Capability Contract
- Inputs To Ask For
- Outputs (Concise)
- Safety & Trust Boundaries
- Decision Routing
- Workflows (Fast Path)
- Trust Center Resolution Flow
- Error Handling
- Security and Privacy
- Reference
- Examples
Files
SKILL.mdcore12,810 bytesreferences/REFERENCE.mddoc13,419 bytes
Read SKILL.md
# Corsair Skill - Agentic Compliance Substrate
Corsair is a protocol layer that makes compliance evidence verifiable, portable, and agent-consumable. This skill provides deterministic workflows for signing, verifying, diffing, and discovering proofs without building new scanners.
Core primitives: SIGN, LOG, PUBLISH (trust.txt), VERIFY, DIFF, SIGNAL (FLAGSHIP)
---
## Security Notes (Review-Focused)
This skill is documentation and workflow guidance, not executable code. It does instruct running the `corsair` CLI and `bun` runtime when explicitly requested by the user.
Guardrails that MUST be followed:
- Never install Bun, Corsair, or any dependency without explicit user confirmation.Skills included
- corsair
Repository facts
- License
- Apache-2.0
- Created
- Feb 1, 2026
- Last pushed
- Feb 28, 2026
- Forks
- 1
- Open issues
- 0
- Project activity
- Slowing
Before you install
Instructions onlyAutomated signals, not a guarantee
Checked Nov 5, 2026
- No broad tool permissions
- No dangerous shell commands
- 17 network referencesin 2 files: corsair/SKILL.md:7 corsair/references/REFERENCE.md:407
- No hidden or obfuscated text
- No instruction overrides
- No executable scripts
- 2 references to secretsin 1 file: corsair/SKILL.md:48
- No requests to vote in Hot
Show all 19 signals by file
skills/corsair/SKILL.md
- Network accessline 7
author: grcorsair version: "2.3" website: https://grcorsair.com - Network accessline 8
version: "2.3" website: https://grcorsair.com --- - Network accessline 9
website: https://grcorsair.com - Access to secretsline 48
[Credential-related source omitted] - Network accessline 158
- `/.well-known/trust.txt` (or delegated DNS) 5. If root hosting is blocked, offer delegated DNS: - TXT: `_corsair.example.com TXT "corsair-trusttxt=https://trust.example.com/trust.txt"` - Network accessline 159
5. If root hosting is blocked, offer delegated DNS: - TXT: `_corsair.example.com TXT "corsair-trusttxt=https://trust.example.com/trust.txt"` - Optional integrity pin: `_corsair.example.com TXT "corsair-trusttxt-sha256=<sha256>"` - Network accessline 160
- TXT: `_corsair.example.com TXT "corsair-trusttxt=https://trust.example.com/trust.txt"` - Network accessline 218
7. Publish: - Host the pack at a URL **or** - Submit it to the community registry at `https://github.com/grcorsair/mappings` - Network accessline 220
- Submit it to the community registry at `https://github.com/grcorsair/mappings` - Network accessline 226
1. Clone `https://github.com/grcorsair/mappings` (if not already). - Network accessline 300
Keyless sign: `corsair sign --file evidence.json --auth-token $OIDC_TOKEN --api-url https://api.grcorsair.com` - Network accessline 301
[Credential-related source omitted] - Access to secretsline 301
[Credential-related source omitted]
skills/corsair/references/REFERENCE.md
- Network accessline 407
# Corsair Trust Discovery DID: did:web:example.com SCITT: https://example.com/scitt/entries?issuer=did:web:example.com - Network accessline 408
DID: did:web:example.com SCITT: https://example.com/scitt/entries?issuer=did:web:example.com CATALOG: https://example.com/compliance/catalog.json - Network accessline 409
SCITT: https://example.com/scitt/entries?issuer=did:web:example.com - Network accessline 410
CATALOG: https://example.com/compliance/catalog.json - Network accessline 411
FLAGSHIP: https://example.com/api/ssf/stream - Network accessline 419
- TXT: `_corsair.example.com TXT "corsair-trusttxt=https://trust.example.com/trust.txt"`
How the signals fit together
Facts from a static read of the files at the pinned commit. They describe what the code does, not why.
Signal confidence: 19 facts
- Network access in the frontmatter of the SKILL.mdcorsair/SKILL.md:7Low confidence
- Network access in the frontmatter of the SKILL.mdcorsair/SKILL.md:8Low confidence
- Network access in the frontmatter of the SKILL.mdcorsair/SKILL.md:9Low confidence
- Access to secrets in prose of the SKILL.md: a variable, placeholder or call, not a stored valuecorsair/SKILL.md:48Low confidence
- Network access in prose of the SKILL.mdcorsair/SKILL.md:158Low confidence
- Network access in prose of the SKILL.mdcorsair/SKILL.md:159Low confidence
- Network access in prose of the SKILL.mdcorsair/SKILL.md:160Low confidence
- Network access in prose of the SKILL.mdcorsair/SKILL.md:218Low confidence
- Network access in prose of the SKILL.mdcorsair/SKILL.md:220Low confidence
- Network access in prose of the SKILL.mdcorsair/SKILL.md:226Low confidence
- Network access in prose of the SKILL.mdcorsair/SKILL.md:300Low confidence
- Network access in prose of the SKILL.mdcorsair/SKILL.md:301Low confidence
- Access to secrets in prose of the SKILL.md: a variable, placeholder or call, not a stored valuecorsair/SKILL.md:301Low confidence
- Network access in code of documentationcorsair/references/REFERENCE.md:407Low confidence
- Network access in code of documentationcorsair/references/REFERENCE.md:408Low confidence
- Network access in code of documentationcorsair/references/REFERENCE.md:409Low confidence
- Network access in code of documentationcorsair/references/REFERENCE.md:410Low confidence
- Network access in code of documentationcorsair/references/REFERENCE.md:411Low confidence
- Network access in prose of documentationcorsair/references/REFERENCE.md:419Low confidence
Works with
| Agent | Status | Evidence | Install to |
|---|---|---|---|
| Claude Code | Compatible | Standard SKILL.md skills/corsair/SKILL.md | .claude/skills/<skill-name>/ |
| Codex | Native | Manifest AGENTS.md | .agents/skills/<skill-name>/ |
| Cursor | Compatible | Standard SKILL.md skills/corsair/SKILL.md | .cursor/skills/<skill-name>/ |
| Gemini CLI | Compatible | Standard SKILL.md skills/corsair/SKILL.md | .gemini/skills/<skill-name>/ |
| GitHub Copilot | Compatible | Standard SKILL.md skills/corsair/SKILL.md | .github/skills/<skill-name>/ |
| OpenCode | Compatible | Standard SKILL.md skills/corsair/SKILL.md | .opencode/skills/<skill-name>/ |
- Native The repository ships a manifest, folder or frontmatter field for this agent.
- Compatible A standard SKILL.md that this agent can read.
- Unknown No evidence either way.
Derived automatically from paths, manifests and frontmatter. Not tested on each agent.
