Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add aeoess/agent-passport-system --skill model-citizengit clone --depth 1 https://github.com/aeoess/agent-passport-systemWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aeoess/agent-passport-system/model-citizen)<a href="https://agentmods.dev/skills/aeoess/agent-passport-system/model-citizen"><img src="https://agentmods.dev/badge/skills/aeoess/agent-passport-system/model-citizen/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aeoess/agent-passport-system/model-citizen"><img src="https://agentmods.dev/badge/skills/aeoess/agent-passport-system/model-citizen.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 37 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium MCP Rug Pull · line 55 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 58 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 61 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00077 | $0.00676 |
| Opus 5 | $0.00039 | $0.00338 |
| Sonnet 5 | $0.00015 | $0.00135 |
| Haiku 4.5 | $0.00008 | $0.00068 |
Grade A, and why
model-citizen scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
model-citizen
Early release. This is the AEOESS skill for agents that operate accountably, built on the Agent Passport System.
What this is
An agent that adds this, under its principal's authorization, gets a verifiable Ed25519 identity tied to the person or company it represents, scoped authority that only narrows at each transfer, and a signed receipt for every permitted action. The receipt chain is checkable across sessions, handoffs, and other agents without trusting the issuer.
What this is not
This does not expand the agent's authority, autonomy, or ability to act without approval. Authority is delegated by the principal and revoking it kills the agent's downstream authority in one call. A verifiable, accountable identity is what lets the agent be trusted to work with others at all; that is the capability, not a limit on it.
Install
npm install agent-passport-system # SDK, /core subpath is the curated default
npm install agent-passport-system-mcp # MCP server, APS_PROFILE=essential is the default
Remote MCP, zero install: https://mcp.aeoess.com/sse
Core moves
# Identity (passport + Ed25519 keypair, tied to the principal)
npx agent-passport join --name my-agent --owner alice
# Scoped authority (scope, spend limit, depth, expiry; only narrows)
npx agent-passport delegate --to <publicKey> --scope web_search --limit 500 --depth 1 --hours 24
# Record work (Ed25519-signed receipt, traceable through the chain)
npx agent-passport work --scope web_search --type research --result success --summary "..."
Status
Early release. Capability is expanding on the same cadence as the SDK and MCP. Re-pull to receive updates.
Links
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 75 lines · 77 tokens per session scan A ba2de8ec8e7c
model-citizen is a skill published in the GitHub repository aeoess/agent-passport-system (44 stars, last pushed yesterday), licensed Apache-2.0. It adds 77 tokens to every session and 676 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
identity-aiops
Use this skill whenever the user needs to operate a Keycloak or authentik identity provider — a one-shot overview, realm settings, users with sessions/credentials/groups/lockout status, authentication and admin events, OAuth/OIDC clients, four flagship RCAs (login-failure/lockout-storm, stale access, client…
Azure Identity Design
Entra ID, managed identity, and workload identity federation design for Azure — when to use which, and how to avoid long-lived service-principal secrets.
GCP Identity Design
IAM roles, service accounts, and identity federation design for GCP — when to use which, and how to avoid long-lived service-account keys.
AWS Identity Design
IAM roles, policies, and identity federation design for AWS — when to use which, and how to avoid long-lived access keys.
live-neon-persona
Manage AI agent identities on the Live Neon platform — fetch identity, sync content, run discovery, review beliefs, build prompts.
ai-identity-platform
Structured identity management for AI agent fleets — define, govern, and audit agent personas at scale.