Check the evidence.
Verify the signature.

A SkillCanary badge records a reviewed version and exact skill-file contents. Verification checks the issuer’s signature, content hash, expiry, and signed revocation list. It does not establish that the skill is harmless.

Get the verification files

Obtain your badge from the publisher and the exact SKILL.md that was reviewed. Download the verification key from this official site independently of the badge, then keep that key pinned. Do not substitute a key supplied by an untrusted badge.

Issuer key fingerprint (SHA-256 of the raw Ed25519 public key):
e714d1ced919daeea358e9b0d384b083d4d0bdea3aa99b115c64db0d47a47841

Run locally

python3 -m pip install -r requirements.txt
python3 verify.py --badge badge.json \
  --public-key issuer-public-key.pem \
  --skill SKILL.md --revocations revocations.json

VALID with exit status 0 means all supported verification checks passed. A changed skill, altered badge, expired badge, revoked badge, or stale revocation list returns INVALID. Fetch the current revocation list before checking; its signed freshness deadline is enforced.

Any changed skill content needs new scans and a newly issued badge. No customer or payment details are included in public verification files.