Claude Skill MartBrowse skillsWhat is a Skill?
 
← Back to list

Agent Decision Receipts

Mints tamper-evident, post-quantum-signed receipts for consequential agent actions and verifies them offline from the certificate alone.

Security & ReviewAdvanced★ 24,151⑂ 3,405AI score 8/10Last updated: Aug 9, 2026

What it does

When an autonomous agent takes an irreversible action — deploy, delete, pay, grant access, or a model decision affecting a person — this skill produces a receipt you can prove later. Logs can be silently edited; a receipt breaks its hash and signature if a single byte changes.

The skill covers exactly three decisions:

  1. Does this action need a receipt? — side-effecting + consequential + later-provable = yes. Read-only or trivially reversible actions are deliberately skipped so the signal doesn't drown.
  2. Mint it — build an action manifest with the four required keys (agent_id, operation, target, policy) via the stdlib-only build_action_manifest.py, then sign with Ed25519 plus post-quantum legs ML-DSA-65 (FIPS 204) and SLH-DSA (FIPS 205).
  3. Verify it — recompute sha256(canonical(evidence)), check each signature leg, using nothing but the receipt: no database, no network, no trust in the issuer.

Crypto is delegated to the open-source openagentontology package (Apache-2.0); this skill is the decision layer around it.

Who it's for

  • Compliance and risk teams building EU AI Act Article 12 or ISO 42001 evidence
  • Platform/SRE engineers running agents that deploy, pay, or export data automatically
  • Organizations that must later demonstrate to auditors, insurers, or regulators what an agent did and under which policy

Examples

  • Production deploy: mint a receipt just before deploy prod/api under the internal change-control policy, so a later incident review can prove which agent and which approval rule applied.
  • High-risk model decision: an automated insurance denial stores only inputs_hash instead of raw applicant data, satisfying record-keeping without exposing PII.
  • Offline audit: six months on, a reviewer runs verify_receipt(receipt) and gets {ok: True, sig_ok: True, legs: [ed25519, ml_dsa, slh_dsa]} without contacting the issuing system at all.

· · · Install guide · · ·

Install in the Claude app (no terminal)
  1. Download the ZIP with the button below.
  2. In Claude, open Settings → Capabilities and turn on 'Code execution and file creation'. (one time)
  3. Go to Customize → Skills → + → 'Upload a skill' and upload the ZIP.
↓ Download ZIP
Install in Claude Code

Let Claude do it — paste this into Claude Code

Install the skill I found on Claude Skill Mart.
Copy the .gemini/skills/agent-decision-receipts folder from the GitHub repo alirezarezvani/claude-skills into my ~/.claude/skills/agent-decision-receipts/.
When it's done, tell me in one line what this skill can do.

Install with a command instead

git clone https://github.com/alirezarezvani/claude-skills.git /tmp/claude-skills && mkdir -p ~/.claude/skills && cp -r /tmp/claude-skills/.gemini/skills/agent-decision-receipts ~/.claude/skills/

⚠ This is a third-party skill. Check the source repository before installing.

  1. Open a terminal and clone the repository: git clone https://github.com/alirezarezvani/claude-skills.git
  2. Create your skills directory if needed: mkdir -p ~/.claude/skills
  3. Copy just this skill: cp -r claude-skills/.gemini/skills/agent-decision-receipts ~/.claude/skills/
  4. Install the open-source signing primitive: pip install "openagentontology[pq]" — the [pq] extra adds the post-quantum signature legs.
  5. Restart Claude Code and prompt with something like "mint a decision receipt before this deploy".
  6. Smoke test: python scripts/build_action_manifest.py --agent test-agent --operation deploy --target staging/api --policy "EU AI Act Art 12" --out action.json
  7. Safety notes: never store the signing key alongside receipts, never commit it, and keep secrets/PII out of the manifest (use inputs_hash).
View source on GitHub ↗License: MIT