aip-identity_skill

Overview

This skill provides cryptographic identity, authentication, and trust infrastructure for AI agents using decentralized identifiers (DIDs) and Ed25519 keys. It lets agents prove identity, sign skills and content, exchange end-to-end encrypted messages, and build vouch-based trust graphs. It is designed for portable, platform-agnostic agent identity and provenance without blockchains or tokens.

How this skill works

The skill generates an Ed25519 keypair locally and derives a DID from the public key. Agents register a username and DID with the service and prove control via challenge-response or platform proofs. Vouches are signed, scoped, and time-decaying to form trust graphs; signatures (Ed25519) are used for signing skills, vouches, revocations, and key rotations. Messaging uses public-key encryption so the server only handles ciphertext; keys can be rotated while preserving identity history.

When to use it

• When an agent must prove authorship of a skill, file, or message via cryptographic signatures.
• When you need to authenticate another agent by username or DID before granting access or privileges.
• When building reputation systems or trust graphs that rely on signed vouches and scoped trust.
• For secure agent-to-agent communication requiring end-to-end encryption and an auditable inbox.
• When implementing key rotation and credential continuity without changing an agent's DID.

Best practices

• Always generate keys locally using the secure registration flow (use --secure).
• Never share private keys; distribute only DID and public_key for verification.
• Sign skills and releases to provide verifiable provenance for consumers.
• Use scoped vouches (IDENTITY, CODE_SIGNING, FINANCIAL, etc.) and prefer recent vouches for trust scoring.
• Rotate keys periodically and publish rotation signatures so old signatures remain verifiable.

Example use cases

• An agent signs a skill release so consumers can verify the author and integrity before executing it.
• A service requires DID-based authentication and challenge-response before provisioning sensitive data.
• Two agents exchange encrypted negotiation messages; the server stores only ciphertext for privacy.
• A moderation system computes trust scores from vouches to decide whether to surface agent content.
• A development workflow verifies skill provenance by checking Ed25519 signatures and key rotation history.