Openclaw Skill

Identity infrastructure for AI agents — register identities, issue tokens, delegate to sub-agents, revoke credentials, manage policies

This skill is coherent with its stated purpose, but it performs high-impact identity operations. Before installing: 1) Only supply a ZEROID_API_KEY that is scoped with the minimum privileges needed (avoid a root/admin key). 2) Verify ZEROID_BASE_URL is the official/trusted endpoint (don’t point it at an unknown or third-party URL). 3) Prefer short-lived, scoped service credentials and enable audit logging on the ZeroID service so all creates/issuances/revocations are recorded. 4) Decide whether you want the agent to act autonomously with these powers; if not, restrict model invocation or require human approval for high-risk operations. 5) Review the upstream project (homepage) and run tests in a staging environment before granting access in production. If you can provide the exact privilege model for the ZEROID_API_KEY (scopes, allowed endpoints, and whether it can create API keys), I can raise or lower the concern level.

Type: OpenClaw Skill Name: zeroid Version: 1.0.0 The 'zeroid' skill bundle provides documentation and command templates for an AI agent to interact with the ZeroID identity infrastructure API. It includes standard operations for agent registration, OAuth2 token issuance, delegation via RFC 8693, and policy management using curl. No indicators of malicious intent, data exfiltration, or prompt injection were found; the skill functions as a legitimate utility for managing SPIFFE-based agent identities.