# Installing the kSig salted-key-derivation skill

This is a **local install**, not something you point an agent at over the web. An
agent fetching a URL and following it as instructions is a known prompt-injection
shape — a well-behaved agent should refuse it, and one correctly did during testing.
So instead: **you** download the release, verify it, and install it yourself. Once
installed, your agent uses it like any other local skill — no network fetch involved
at run time.

## What you're installing

A small, self-contained derivation tool for **KSIG-SALT-v1** (see
[SPEC-SALT-DERIVE.md](SPEC-SALT-DERIVE.md)): given a master **public** key and a list
of **salts** (e.g. Hedera account ids), it computes the corresponding child public
keys. No seed, private key, or key fragment is ever needed for this — that's the
whole point of the scheme.

## 1. Download the release and its checksum

```bash
curl -sO https://lab21.ksig.uk/releases/ksig-salt-derive-v1.0.0.tar.gz
curl -sO https://lab21.ksig.uk/releases/ksig-salt-derive-v1.0.0.SHA256SUMS
```

## 2. Verify the SHA-256 before trusting anything inside it

```bash
sha256sum -c ksig-salt-derive-v1.0.0.SHA256SUMS
```

Expect: `ksig-salt-derive-v1.0.0.tar.gz: OK`

**This check only means something if the expected hash reached you independently of
this download** — e.g. you noted it yourself after an earlier audit, or it's quoted
directly to you by someone you trust, rather than only ever having been read off this
same site. The current release hash:

```
cc8164ecaa85be455cd3764e9909cb3eccf53259a874c75d6b9c633d95b58bb3  ksig-salt-derive-v1.0.0.tar.gz
```

## 3. Extract

```bash
tar xzf ksig-salt-derive-v1.0.0.tar.gz
```

This produces a `ksig-salt-derive/` folder containing `SKILL.md`, `derive-cli.js`,
`ksig-derive.js`, `nacl-fast.min.js`, and an internal `CHECKSUMS.txt` for the
individual files.

## 4. Install

Pick one:

```bash
# available to every project for your user:
mkdir -p ~/.claude/skills
cp -r ksig-salt-derive ~/.claude/skills/

# available to one project only:
mkdir -p /path/to/your/project/.claude/skills
cp -r ksig-salt-derive /path/to/your/project/.claude/skills/
```

Claude Code auto-discovers the skill from either location — no restart, no install
command, nothing else to configure.

## 5. Use it

Tell your agent what you want directly — no URL, no fetch:

> Use the ksig-salt-derive skill to derive child public keys. Master public key:
> `<your master public key>`. Salts: `<your salt list, or a rule to expand>`.

## Updating later

Repeat steps 1–4 with a newer release when one is published. Nothing auto-updates —
that's deliberate, so a new version is only trusted after the same manual check.

## References

- Cryptographic spec: [SPEC-SALT-DERIVE.md](SPEC-SALT-DERIVE.md)
- Interactive batch page, for spot-checking any result yourself in a browser:
  [derive.php](derive.php)
- All releases: [releases/](releases/)