The Agent Skills Directory

[PROMPT_INJECTION]: The instructions explicitly direct the agent to "do not ask 'want me to start?' first" and to begin the bootstrap process immediately when invoked. This bypasses standard user confirmation protocols for high-stakes identity operations.
[CREDENTIALS_UNSAFE]: The skill is designed to access and manage sensitive files located in the ~/.agent-id directory, specifically keys/main.json (containing Ed25519 keypairs) and owner-session.json (containing OIDC ID, access, and refresh tokens).
[DATA_EXFILTRATION]: The export-proof command is designed to emit the owner session and refresh tokens directly to stdout. This behavior allows highly sensitive credentials to enter the agent's context window, where they could be logged or inadvertently exfiltrated through subsequent agent actions.
[COMMAND_EXECUTION]: All core lifecycle operations rely on the execution of a local Node.js CLI script (bin/cli.mjs) using the Bash tool, granting the agent direct execution capabilities over the identity management logic.
[INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect injection by processing responses from external identity providers and accepting arbitrary JSON payloads in the sign command without predefined sanitization.
Ingestion points: Processes output from node CLI status, node CLI auth, and external provider responses.
Boundary markers: No explicit delimiters or warnings to ignore instructions within the identity payloads are provided.
Capability inventory: Access to Bash (node, curl, jq) and Read tools.
Sanitization: The instructions do not define methods for validating or escaping external payloads prior to processing.

agent-id-core