Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ShurikenTrade/shuriken-skills --skill agent-keysgit clone --depth 1 https://github.com/ShurikenTrade/shuriken-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/shurikentrade/shuriken-skills/agent-keys)<a href="https://agentmods.dev/skills/shurikentrade/shuriken-skills/agent-keys"><img src="https://agentmods.dev/badge/skills/shurikentrade/shuriken-skills/agent-keys/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/shurikentrade/shuriken-skills/agent-keys"><img src="https://agentmods.dev/badge/skills/shurikentrade/shuriken-skills/agent-keys.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00034 | $0.00583 |
| Opus 5 | $0.00017 | $0.00292 |
| Sonnet 5 | $0.00007 | $0.00117 |
| Haiku 4.5 | $0.00003 | $0.00058 |
Grade A, and why
agent-keys scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 35 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Using agent keys
Agent keys are Shuriken's credential primitive for programmatic access. They authenticate a caller, carry a set of scopes defining what the caller can do, and are revocable without affecting the owning user's session.
Approach
- One key per integration, not per user action. An agent key represents a long-lived integration. Do not create a key per request.
- Grant the minimum scope. See
shuriken:scopingfor how scopes are structured and how to reason about least-privilege. - Treat keys as secrets. Store them in environment variables or secret managers. Never hard-code. Never log. Never commit.
Key lifecycle
- Create at app.shuriken.trade/agents (the authenticated user's agent-key management page), or via the agent-key management API once bootstrapped. The key is displayed once at creation — capture it immediately.
- Use the same agent key across every surface:
- REST — pass the key in the
Authorization: Bearer <key>header on every request. - WebSocket — authenticate the connection with the same agent key (subject to the key's scopes, just like REST). The streaming endpoints share the same credential model; there is no separate websocket token.
- SDKs — both the TypeScript and Rust SDKs accept the agent key directly in the client constructor. Prefer the SDK path when the user's language is supported; it handles header/connection wiring for you.
- REST — pass the key in the
- Rotate periodically and after any suspected compromise. Rotation means: create the new key, deploy it to the consuming service, then revoke the old key. Not the reverse.
- Revoke when an integration is retired, a contractor departs, or the key is exposed. Revocation is immediate.
One user, one integration
An agent key belongs to a single Shuriken user. An integration holds that user's key (or the few keys that user has created for different purposes). There is no multi-tenant flow where an app mints keys on behalf of many users — every key is owned by the Shuriken account that created it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 35 lines · 34 tokens per session scan A 0814f754df0f
agent-keys is a skill published in the GitHub repository ShurikenTrade/shuriken-skills (90 stars, last pushed 4mo ago), licensed MIT. It adds 34 tokens to every session and 583 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
coinversaa-pulse
Read-only crypto intelligence for AI agents. 103 tools (OAuth 2.1 on the hosted endpoint, API key for local stdio) for Hyperliquid trader analytics, builder-fee revenue analytics, position lifecycles with MAE/MFE execution quality, trader archetype discovery, behavioral cohorts, HIP-4 outcome contracts, outcome/perp…
crypto-report
Analyze cryptocurrency projects with tokenomics, on-chain metrics, and market analysis. Generate comprehensive crypto research reports.
crypto-analyze
Full Crypto Analysis Orchestrator — launches 5 parallel subagents for comprehensive multi-dimensional token analysis with composite Crypto Score.
crypto-onchain
On-Chain Analytics Agent — whale movements, exchange flows, active addresses, network growth, holder distribution, and transaction metrics with On-Chain Score (0-100).
emblem-memecoin-scout
Memecoin discovery and risk assessment via EmblemAI. Trending memecoins on Solana, Base, and Hedera. Pump.fun and LaunchLab new token alerts, Clanker discovery, rug-pull detection, holder analysis, and smart money tracking. Use when the user wants to find new memecoins, check if a token is a rug pull, or scout…
emblem-defi-yield
DeFi yield research and liquid staking via EmblemAI. Discover yield opportunities, compare protocols, check DeFi positions with Nansen, and enter liquid staking via token swaps. Use when the user wants to research yields, find staking options, or review DeFi positions.