skills.rest
grcorsair
grcorsairOFFICIAL
Explore all skills by this author →
GitHub

corsair

Sign, verify, diff, and publish JWT-VC CPOEs from tool output.

14|1|Updated Feb 1, 2026
Search Tags:#jwt#compliance#corsair#cpoe#trust.txt#verifiable-credential#did:web
One-click install
npx skills add https://github.com/grcorsair/corsair --skill corsair
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: corsair
Source: https://github.com/grcorsair/corsair/tree/main/skills/corsair
Command: npx skills add https://github.com/grcorsair/corsair --skill corsair

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Cryptographic compliance verification by turning tool output into verifiable, portable proofs (CPOEs) and enabling trust discovery and drift detection without building new scanners.

Core Features & Use Cases

  • Sign tool output into JWT-VC CPOEs for cryptographic proof
  • Verify proofs via trust.txt catalogs and SCITT entries
  • Diff proofs to detect drift and assess third-party risk
  • Discover proofs and publish trust artifacts for governance

Quick Start

Ask Corsair to sign your evidence file and verify the resulting CPOE with the sign and verify workflows.

Frequently Asked Questions about corsair

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create verifiable credentials from tool output for compliance checks?▼

To create verifiable credentials, you sign tool output into JWT-VC CPOEs using the SIGN workflow, which provides cryptographic proof of compliance without building new scanners.

Can I use trust.txt catalogs to verify cryptographic proofs?▼

Yes, you can verify cryptographic proofs using the VERIFY workflow, which validates JWT-VC CPOEs against trust.txt catalogs and SCITT entries for vendor assessments.

What is the best way to detect configuration drift in third-party vendor risk assessments?▼

The best way to detect drift is using the DIFF workflow to compare signed CPOEs, which highlights changes in tool output to assess third-party risk and ensure compliance.

Do I need the Bun runtime to sign and publish verifiable credential proofs?▼

Yes, you need the Bun runtime and the Corsair CLI installed to execute workflows like SIGN, PUBLISH, and DISCOVER for handling secure key generation and trust artifact publication.

How does trust.txt discovery work for finding published compliance proofs?▼

Trust.txt discovery uses the DISCOVER workflow to locate published CPOEs and trust artifacts across remote endpoints, applying guardrails around remote content for secure governance.

What are the limitations when using JWT-VC for cryptographic compliance verification?▼

Limitations include requiring the Bun runtime and Corsair CLI, as the workflows enforce strict guardrails around remote content fetching and secure key handling to prevent unauthorized access.

Related Skills

Explore More Legal & Compliance Skills→
zomeruzomeru

bun

Automates JavaScript/TypeScript builds, tests, and installs with Bun's native tools.

Community
Advanced
LeoWSY-hashblueLeoWSY-hashblue
3

techstack-security

Analyze HTTP headers, DNS records, and security endpoints to catalog third-party SaaS vendors.

Community
Advanced
OrcaQubitsOrcaQubits
35

ap2-vdc-framework

Implement SD-JWT Verifiable Digital Credentials with Key Binding for agentic payments.

Official
Advanced
harkersharkers

vendor-assessor-agent

Assess vendor privacy and security posture with evidence-backed findings.

Community
Intermediate