Individual skill
verify-sign
Add an Artifact Verification (SscaArtifactVerification) step to an existing Harness pipeline to verify Cosign signatures on container or local-stage artifacts. Supports CI, Security, and CD Deploy (containerized step group). Supports Third-Party registries (Docker, ECR, GCR, GAR, ACR), Harness Artifact Registry (HAR), and Harness Local Stage artifacts. Only works with existing pipelines. Use when asked to verify signed artifacts, verify artifact signature, verify-sign, validate Cosign signature, or configure SscaArtifactVerification. Trigger phrases: verify sign, verify artifact, artifact verification, verify signature, verify-sign, SscaArtifactVerification, verify signed image, verify Cosign, HAR verification.
skills/security/verify-sign/SKILL.md
Source commit e01dc7275f7e261f390be2fe7be4559feadb74ef
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 11, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 134
- Repository last updated
- Oct 28, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent-skills Repository topic
- agents Repository topic
- devops Derived category
- security Derived category
- devops-containers Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 18,079 bytesSKILL.mdcore · 18,079 bytesSKILL.mdcore · 18,079 bytesSKILL.mdcore · 18,079 bytesSKILL.mdcore · 18,079 bytesSKILL.mdcore · 18,079 bytesreferences/artifact-verification-step.mddoc · 5,940 bytesreferences/cd-containerized-step-group.mddoc · 5,254 bytesreferences/interactive-wizard-flow.mddoc · 6,094 bytes
Read excerpt
# Verify Sign
Add an **Artifact Verification** (`SscaArtifactVerification`) step to an existing Harness pipeline.
The step verifies Cosign signatures on artifacts — typically immediately after `SscaArtifactSigning`.
This skill only works with **existing pipelines** — do not create standalone verification-only pipelines.
**Prerequisites:** Artifact must already be signed (typically via `/sign-artifact` /
`SscaArtifactSigning`). Key-based verify requires the Cosign **public** key file secret matching the
signing private key (`/create-secret`). If signing did not upload `.sig` to the registry, Harness
pulls the signature from its database during verification.
**Supported stages:** CI, Security, and CD (`Deployment` in containerized step group before deploy).
