{
  "cells": [
    {
      "cell_type": "markdown",
      "id": "skills-intro",
      "metadata": {},
      "source": "# Discover and verify an agent Skill\n\nBrowse the public Skills catalogue, then verify the official Super ii Skill manifest, file hashes, and Ed25519 signature before setup. Discovery never means automatic installation or trust."
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "id": "skills-catalog",
      "metadata": {},
      "outputs": [],
      "source": "import base64\nimport hashlib\nimport json\nfrom urllib.request import Request, urlopen\n\nORIGIN = \"https://superii.site\"\n\ndef get_bytes(path):\n    request = Request(f\"{ORIGIN}{path}\", headers={\"Accept\": \"application/json, text/plain\"})\n    with urlopen(request, timeout=20) as response:\n        return response.read()\n\ncatalog = json.loads(get_bytes(\"/api/skills\"))\nprint(f\"Catalogue version: {catalog['version']} · entries: {len(catalog['skills'])}\")\nfor skill in catalog[\"skills\"][:10]:\n    print(f\"- {skill['name']} [{skill['category']}]\")"
    },
    {
      "cell_type": "markdown",
      "id": "verify-signature",
      "metadata": {},
      "source": "## Verify the signed official manifest\n\nInstall `cryptography` in the notebook environment. Verification uses the exact downloaded UTF-8 bytes and checks the declared key identifier before validating every file checksum."
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "id": "signature-check",
      "metadata": {},
      "outputs": [],
      "source": "from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey\n\nbase = \"/skills/superii\"\nmanifest_bytes = get_bytes(f\"{base}/manifest.json\")\nmanifest = json.loads(manifest_bytes)\nsignature = json.loads(get_bytes(f\"{base}/signature.json\"))\npublic_key = json.loads(get_bytes(f\"{base}/public-key.json\"))\n\nif signature[\"key_id\"] != public_key[\"key_id\"]:\n    raise RuntimeError(\"Manifest key identifier mismatch\")\nkey_bytes = base64.b64decode(public_key[\"public_key\"], validate=True)\nif hashlib.sha256(key_bytes).hexdigest() != public_key[\"sha256\"]:\n    raise RuntimeError(\"Public-key checksum mismatch\")\nEd25519PublicKey.from_public_bytes(key_bytes).verify(\n    base64.b64decode(signature[\"signature\"], validate=True), manifest_bytes\n)\nprint(f\"Signature verified with {signature['key_id']}\")"
    },
    {
      "cell_type": "code",
      "execution_count": null,
      "id": "skill-file-checks",
      "metadata": {},
      "outputs": [],
      "source": "for item in manifest[\"files\"]:\n    payload = get_bytes(f\"{base}/{item['path']}\")\n    actual = hashlib.sha256(payload).hexdigest()\n    if actual != item[\"sha256\"]:\n        raise RuntimeError(f\"Checksum mismatch: {item['path']}\")\n    print(f\"verified {item['path']}\")"
    },
    {
      "cell_type": "markdown",
      "id": "skills-review-boundary",
      "metadata": {},
      "source": "## Review before setup\n\nRead `SKILL.md` and every referenced instruction, confirm the requested permissions and destinations, and install only through a visible agent control you trust. This notebook verifies origin and bytes; it does not decide whether the Skill is appropriate for your task."
    }
  ],
  "metadata": {
    "kernelspec": {"display_name": "Python 3", "language": "python", "name": "python3"},
    "language_info": {"name": "python", "version": "3.12"}
  },
  "nbformat": 4,
  "nbformat_minor": 5
}