How do I install the Swain Keys skill?

Run npx skillmds@latest add cristoslc/swain-keys in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Swain Keys safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Swain Keys?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Swain Keys free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Swain Keys?

cristoslc (@cristoslc) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Swain Keys by cristoslc — Agent Skill

Name: Swain Keys
Author: cristoslc

Swain Keys

Per-project SSH key provisioning for git signing and authentication. Generates ed25519 keys, configures git signing, registers on GitHub, and sets up SSH host aliases to bypass global agents (e.g., 1Password).

cristoslc 0cd5633 3 files · 31.7 KB Updated Sep 17, 2026

File contents

swain-keys

Per-project SSH key provisioning for git signing and authentication.

When invoked

Locate and run the provisioning script at skills/swain-keys/scripts/swain-keys.sh:

SCRIPT="$(find . .claude .agents -path '*/swain-keys/scripts/swain-keys.sh' -print -quit 2>/dev/null)"

If the path search fails, glob for **/swain-keys/scripts/swain-keys.sh.

Workflows

Default (no arguments or "set up keys")

Run --status first to show current state:

bash "$SCRIPT" --status

If keys are not fully provisioned, ask the user if they'd like to proceed with provisioning.

Provision ("provision keys", "configure signing", "set up SSH")

Run the full provisioning flow:

bash "$SCRIPT" --provision

The script will:

Derive a project name from the git remote or directory
Generate ~/.ssh/<project>_signing (ed25519, no passphrase) if not exists
Create ~/.ssh/allowed_signers_<project> with the configured git email
Add the public key to GitHub via gh ssh-key add for both authentication and signing
Create ~/.ssh/config.d/<project>.conf with a host alias that bypasses global SSH agents
Update the git remote URL to use the project-specific host alias
Set local git config for commit and tag signing
Verify SSH connectivity and signing capability

Status ("key status", "check keys")

bash "$SCRIPT" --status

Verify ("verify keys", "test signing")

bash "$SCRIPT" --verify

Handling scope refresh

If gh ssh-key add fails due to insufficient scopes, the script will print an action-needed message. When this happens:

Tell the user they need to authorize additional GitHub scopes
Show them the command: gh auth refresh -s admin:public_key,admin:ssh_signing_key
This will open a browser for OAuth — it requires human interaction
After they confirm, re-run --provision (idempotent, will skip completed steps)

Integration with swain-init

When called from swain-init, run --provision directly without the status-first flow. swain-init handles the "would you like to?" prompt.

Session bookmark

After provisioning, update the bookmark: bash "$(find . .claude .agents -path '*/swain-session/scripts/swain-bookmark.sh' -print -quit 2>/dev/null)" "Provisioned SSH keys for {project}"

Error handling

If not in a git repo: fail with clear message
If gh CLI unavailable: skip GitHub registration steps, warn user to add keys manually
If git email not configured: fail early with instructions
All steps are idempotent — safe to re-run after fixing issues

---name: swain-keysdescription: Per-project SSH key provisioning for git signing and authentication. Generates ed25519 keys, configures git signing, registers on GitHub, and sets up SSH host aliases to bypass global agents (e.g., 1Password).---# swain-keysPer-project SSH key provisioning for git signing and authentication.## When invokedLocate and run the provisioning script at `skills/swain-keys/scripts/swain-keys.sh`:```bashSCRIPT="$(find . .claude .agents -path '*/swain-keys/scripts/swain-keys.sh' -print -quit 2>/dev/null)"```If the path search fails, glob for `**/swain-keys/scripts/swain-keys.sh`.## Workflows### Default (no arguments or "set up keys")Run `--status` first to show current state:```bashbash "$SCRIPT" --status```If keys are not fully provisioned, ask the user if they'd like to proceed with provisioning.### Provision ("provision keys", "configure signing", "set up SSH")Run the full provisioning flow:```bashbash "$SCRIPT" --provision```The script will:1. Derive a project name from the git remote or directory2. Generate `~/.ssh/<project>_signing` (ed25519, no passphrase) if not exists3. Create `~/.ssh/allowed_signers_<project>` with the configured git email4. Add the public key to GitHub via `gh ssh-key add` for both authentication and signing5. Create `~/.ssh/config.d/<project>.conf` with a host alias that bypasses global SSH agents6. Update the git remote URL to use the project-specific host alias7. Set local git config for commit and tag signing8. Verify SSH connectivity and signing capability### Status ("key status", "check keys")```bashbash "$SCRIPT" --status```### Verify ("verify keys", "test signing")```bashbash "$SCRIPT" --verify```## Handling scope refreshIf `gh ssh-key add` fails due to insufficient scopes, the script will print an action-needed message. When this happens:1. Tell the user they need to authorize additional GitHub scopes2. Show them the command: `gh auth refresh -s admin:public_key,admin:ssh_signing_key`3. This will open a browser for OAuth — it requires human interaction4. After they confirm, re-run `--provision` (idempotent, will skip completed steps)## Integration with swain-initWhen called from swain-init, run `--provision` directly without the status-first flow. swain-init handles the "would you like to?" prompt.## Session bookmarkAfter provisioning, update the bookmark: `bash "$(find . .claude .agents -path '*/swain-session/scripts/swain-bookmark.sh' -print -quit 2>/dev/null)" "Provisioned SSH keys for {project}"`## Error handling- If not in a git repo: fail with clear message- If `gh` CLI unavailable: skip GitHub registration steps, warn user to add keys manually- If git email not configured: fail early with instructions- All steps are idempotent — safe to re-run after fixing issues

Frequently asked questions