samerismail

6 ms·

1. 1.▲
   by samerismail 7mo ago

   You're right that's the confused deputy problem, and it's a valid attack vector. If Agent A presents its JWT to Skill B, Skill B could reuse that token to call Skill C pretending to be Agent A. This is a known limitation of b
2. 2.▲
   by samerismail 7mo ago

   Fair critique, let me address both points directly. JWT theft / 60-minute window: This is a real concern, and it's the same tradeoff every token-based system makes (OAuth2, Auth0, Firebase — all use similar TTLs). The mitigations
3. 3.▲
   by samerismail 7mo ago

   Thanks for catching that! The documentation link was pointing to an internal docs route that didn't have a page yet. Just fixed it now links directly to the integration guide on GitHub. Should be live now: https://agent-pass
4. 4.▲
   by samerismail 7mo ago

   Thanks! ERC-8004 is doing really important work, especially the on-chain reputation and validation registries. The co-authors (MetaMask, Ethereum Foundation, Google, Coinbase) are thinking about this at the right level. The way I see the ov
5. 5.▲
   by samerismail 7mo ago

   Great call on SPIFFE/SPIRE. I looked at it early on it's excellent for workload identity in controlled infrastructure (Kubernetes, service meshes), but it assumes you control the environment your workloads run in. The agent identi
6. 6.▲
   Show HN: Agent Passport – OAuth-like identity verification for AI agents

   14 points by samerismail 7mo ago|15 comments