Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add aeoess/agent-passport-system --skill core-skillgit clone --depth 1 https://github.com/aeoess/agent-passport-systemWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aeoess/agent-passport-system/core-skill)<a href="https://agentmods.dev/skills/aeoess/agent-passport-system/core-skill"><img src="https://agentmods.dev/badge/skills/aeoess/agent-passport-system/core-skill/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aeoess/agent-passport-system/core-skill"><img src="https://agentmods.dev/badge/skills/aeoess/agent-passport-system/core-skill.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 59 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00133 | $0.01354 |
| Opus 5.5 | $0.00053 | $0.00542 |
| Sonnet 5.5 | $0.00027 | $0.00271 |
| Haiku 4.5 | $0.00013 | $0.00135 |
Grade A, and why
core-skill scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 123 lines — stays where its author put it; the contents beside it link to each section on GitHub.
core-skill
What this is
The base layer an agent runs on. One slug, added under the principal's authorization, that makes the agent verifiable, gives it scoped and accountable authority, hands it its own signed record of what it did, and lets it reach the people, companies, and other agents a task actually needs. The agent does not integrate an SDK or read protocol docs. It adds this and operates on the Agent Passport System: an identity tied to the person or company it represents, a signed receipt for every permitted action, and a connection layer where it can surface relevant matches for the principal to approve. Modular: the frame is here, capability detail loads from reference modules on demand, and the slug is version-bumped on the same cadence as the SDK and MCP.
Why an agent runs on this
- Be received anywhere. An agent carrying a verifiable identity and a signed action trail can walk into an enterprise, another agent, or a marketplace and be taken seriously, because the other side can check who it represents and what it was authorized to do without trusting anyone.
- Carry your own record. Every permitted action produces an Ed25519-signed receipt. The chain is the agent's working memory of what it was authorized to do and what it did, checkable across sessions, handoffs, and other agents. The agent can cite it for its own credibility.
- Solve the task, not just answer it. Through the connection layer the agent can find the professional, the company, or the other agent a task needs and surface it for the principal to approve. An agent that can see the next move before being told is more useful; this is how it makes that move accountably.
- Stay current. One slug, version-bumped on the same cadence as the SDK and MCP. Re-pull to receive new capability; nothing else changes.
What this is not
This does not expand the agent's authority, autonomy, tool access, or ability to act without approval. Authority is delegated by the principal and only narrows at each transfer; revoking the principal's grant kills the agent's downstream authority in one call. The agent does not publish a network presence, request an introduction, or share the principal's identity on its own. Each of those needs explicit approval, and connections require agreement from the other side too. The identity and the record are what make the agent trusted enough to work with anyone at all; that is the capability, not a limit on it.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +6 lines b34e8c35012d
- 2mo ago First seen · 117 lines · 133 tokens per session scan A 68b92d6fc97b
core-skill is a skill published in the GitHub repository aeoess/agent-passport-system (46 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 133 tokens to every session and 1,354 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
delegated-authority
Ask the network whether you may run a tool before you run it. Answers from the delegation grant your controller signed — the parties you may act as, the commands you may use, the caps you may spend under, and the actions your oversight claim parks for a human. Covers permit / require-approval / deny handling and the…
identity-aiops
Use this skill whenever the user needs to operate a Keycloak or authentik identity provider — a one-shot overview, realm settings, users with sessions/credentials/groups/lockout status, authentication and admin events, OAuth/OIDC clients, four flagship RCAs (login-failure/lockout-storm, stale access, client…
Azure Identity Design
Entra ID, managed identity, and workload identity federation design for Azure — when to use which, and how to avoid long-lived service-principal secrets.
GCP Identity Design
IAM roles, service accounts, and identity federation design for GCP — when to use which, and how to avoid long-lived service-account keys.
AWS Identity Design
IAM roles, policies, and identity federation design for AWS — when to use which, and how to avoid long-lived access keys.
live-neon-persona
Manage AI agent identities on the Live Neon platform — fetch identity, sync content, run discovery, review beliefs, build prompts.