Countersign — AI skill for Claude Code
Your AI agent writes its own 'allow this.
How to install Countersign
This entry records only its repository, not the path inside it, so there is no
exact command to give. Open cyberbobas/countersign and copy the folder into
~/.claude/skills/, or the file into ~/.claude/agents/.
What Countersign does
Your AI agent writes its own 'allow this?' dialog, so it can hide what it's really doing. Countersign draws the dialog itself, so you approve the real command, and every yes becomes a receipt you can check later. Skill pinning, MCP deny, phishing fence.
Alternatives in AI
- Kibitz — Real-time decoded feed of AI agent actions — monitor multiple Claude Code & Codex sessions, see exactly what e 521 ★
- UltraCode Shim — Give Claude Code's ultracode mode to ANY model you already pay for 422 ★
- MioIsland — macOS Dynamic Island for AI coding agents 388 ★
README
Countersign
[](https://pypi.org/project/countersign-agent/) [](https://github.com/cyberbobas/countersign/actions/workflows/tests.yml) [](https://pypi.org/project/countersign-agent/) [](LICENSE)
Your AI coding agent asks "can I run this?", but the agent itself draws that dialog. So it can pad it, fake a "security review", and bury the one line that actually matters. Countersign draws the dialog for you, from the exact command that will run. You approve the real thing, and every yes becomes a receipt in a tamper-proof ledger.
Part of [Agentoffense](https://agentoffense.com), the companion to [Airlock](https://github.com/cyberbobas/airlock). Airlock is the policy firewall (what a call may do). Countersign is the honest human yes (proof that you approved the real call).
pip install countersign-agent
countersign demo # or: csign demoWhat it closes
Four gaps a path firewall does not:
| # | gap | command |
|---|---|---|
| 1 | Honest HITL / LITL: you sign the argv, not the agent's story | countersign askd · countersign approvers · countersign quorum |
| 2 | Census of hidden skills: hold every instruction file you did not pin | countersign census --deny-new |
| 3 | MCP sampling / elicitation / roots deny, both directions of the pipe | countersign-mcp |
| 4 | Inbound fence: a stranger's mail or issue is data, tools frozen | countersign inbound --from email |
| 5 | Receipts: the ledger of consents is hash-chained and checkable | countersign verify · countersign replay |
Not a path firewall. Injection can still *ask*. I
Related Skills
Anvil
Anvil is a single, self-contained AI coding agent for the terminal. The coder is a real agent — it reads, writ
Ink Art
Hand-drawn ink-on-white doodle animation — a character that draws itself then walks/dances/waves, or a deadpan
Second Brain Builder
A Claude skill for a knowledge base that maintains itself, grown into a company brain every agent starts from.
Seedeep
What Claude Code is doing between your prompt and its answer, drawn live from the logs it already writes: ever
Paperclip Vision
A Claude Code skill that interviews your founder and writes the constitution your AI company needs to run itse
Foundling
An AI that wakes every day with no memory, reads what its past selves left behind, adds one small mark, and fo
Related Agents
Lane Lead
Lead of ONE orchestration lane. Receives a brief written with the skill's template, builds it entirely, verifi
Image Approver
Decides approve/reject for ONE generated product image variant for a given SKU and channel (Amazon or Flipkart
Icon Designer
Designs and finishes ONE application icon for the icon-creator plugin - draws the SVG, reviews it at real size
