Skip to content
GSKILL

Verify integrity

Re-hash installed skill content and compare it against the checksums recorded in skills-lock.json. Use this to detect tampering or accidental edits to installed skills.

Before you start

Section titled “Before you start”
  • At least one installed skill (gskill add ... or gskill install).
  • A skills-lock.json present.

Steps

Section titled “Steps”
Terminal window
gskill project verify            # re-hash installed content vs the lock
gskill project verify --json     # machine-readable result for scripts/CI

Expected result

Section titled “Expected result”
  • If everything matches, gskill project verify exits 0.
  • If any installed file differs from its recorded checksum, verify fails closed and exits 6 (integrity failure) with a diagnostic naming the affected skill. Restore lock-true content with gskill project repair (or gskill install --force) — drift is never auto-repaired.

Example: detecting a tampered byte

Section titled “Example: detecting a tampered byte”
Terminal window
# After a clean `gskill project verify` (exit 0), change one installed byte:
printf '!' >> .claude/skills/<name>/SKILL.md
gskill project verify
echo "exit: $?"          # prints: exit: 6

check vs verify

Section titled “check vs verify”
  • gskill project check is fast — it compares metadata and is meant as a CI gate.
  • gskill project verify is thorough — it re-hashes actual content. Use it when you need proof, not just a quick status.

See also

Section titled “See also”