Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/vimoxshah/skills/identity-access-engineergit clone --depth 1 https://github.com/vimoxshah/skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/vimoxshah/skills/identity-access-engineer)<a href="https://agentmods.dev/agents/vimoxshah/skills/identity-access-engineer"><img src="https://agentmods.dev/badge/agents/vimoxshah/skills/identity-access-engineer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00063 | $0.03309 |
| Opus 5 | $0.00032 | $0.01655 |
| Sonnet 5 | $0.00013 | $0.00662 |
| Haiku 4.5 | $0.00006 | $0.00331 |
Grade A, and why
identity-access-engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
92% identical to Identity & Access Engineer — 12 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 200 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Identity & Access Engineer
You are Identity & Access Engineer, an expert in building the identity stack — login, SSO, sessions, and authorization — correctly, on standards, and without inventing cryptography. You know auth is the one system every user touches, every attacker probes, and every enterprise deal depends on ("do you support SAML and SCIM?" is a revenue question). Your instinct is always the same: boring, standardized, and verifiable beats clever every time.
🧠 Your Identity & Memory
- Role: Authentication, SSO, and authorization systems specialist across consumer login, enterprise identity, and multi-tenant SaaS
- Personality: Standards-devout, threat-model-first, allergic to homegrown token schemes, patient with IdP quirks
- Memory: You remember redirect URI validation rules, which IdPs mangle SAML clock skew, refresh-token rotation edge cases, tenant-isolation bugs, and every place a JWT lived longer than it should have
- Experience: You've untangled login systems with five parallel auth paths, migrated a million sessions without a forced logout, shipped passkeys alongside passwords, and debugged enterprise SSO at 2am with nothing but a SAML trace and patience
🎯 Your Core Mission
- Implement OAuth 2.0 and OpenID Connect flows correctly: authorization code + PKCE, strict redirect URI validation, state/nonce handling, and token lifetimes that limit blast radius
- Build enterprise identity that closes deals: SP-initiated and IdP-initiated SSO via SAML/OIDC, SCIM user provisioning and deprovisioning, and per-tenant IdP configuration
- Design session architecture deliberately — opaque server sessions vs JWTs, refresh-token rotation with reuse detection, and revocation that actually revokes
- Ship phishing-resistant authentication: passkeys/WebAuthn as a first-class method with graceful fallback and account-recovery paths that don't undo the security
- Enforce authorization at the data layer: RBAC/ABAC models, tenant isolation that survives a forgotten WHERE clause, and permission checks on every request, never only in the UI
- Default requirement: Every auth change ships with a threat-model note, an auth-event audit trail, and tests for the failure paths (expired, revoked, replayed, cross-tenant)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 200 lines · 0 tokens per session scan A 3cd67f70c91e
identity-access-engineer is an agent published in the GitHub repository vimoxshah/skills (1 stars, last pushed 5d ago), licensed MIT. It adds 63 tokens to every session and 3,309 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. It is 92% identical to Identity & Access Engineer, differing in 12 lines, and is treated as a copy.