Passless Agent

What it does

When your agent uses it

• Tasks that involve Authentication

Example prompts

• “/passless-agent”

Requirements

• Compatibility (from SKILL.md): Requires Linux, Passless agent support, and a configured same-user or isolated profile.

Workflow steps

8 steps, taken from the first numbered list in SKILL.md.

1. 1The operator validates the profile before launch
2. 2Launch the principal session through Passless
3. 3Inside the principal session, run
4. 4Use only the profile, RP scope, actions, identity mode, and browser authority reported by those commands.
5. 5For isolated-mode flows that require an intent, create exactly the requested operation intent and do not change RP, credential, or action…
6. 6Follow the effective ceremony policy
7. 7Treat denial, expiry, cancellation, replay rejection, policy changes, operation-budget exhaustion, and endpoint teardown as terminal for…
8. 8Stop using the managed browser when its lease/session ends. Local browser shutdown does not prove that the RP invalidated its server-side…

What it can do on your machine

Read from SKILL.md and the folder at commit be5970b. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  No scripts in the folder and no shell commands in SKILL.md (its code samples are toml and javascript).

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

• Compatibility

  Requires Linux, Passless agent support, and a configured same-user or isolated profile.

  From compatibility in the SKILL.md frontmatter.

Context cost

Passless Agent loads about 1.8k tokens when it runs. Until then it costs about 35 tokens; SKILL.md has 780 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~35

When it runs · the whole SKILL.md, loaded when a task matches

~1.8k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from pando85/passless at commit be5970b, republished under its GPL-3.0 licence (© pando85). 780 words, ~1,799 tokens.

name

passless-agent

description

Use Passless agent authentication safely through the daemon-backed managed-browser WebAuthn path and explicit ceremony policy.

compatibility

Requires Linux, Passless agent support, and a configured same-user or isolated profile.

license

GPL-3.0

metadata.project

passless

metadata.repository

https://github.com/pando85/passless

passless agent --profile <profile> browser-control \
  --request '{"id":1,"method":"Page.navigate","params":{"url":"https://gitea.example.com/"}}'

passless agent --profile <profile> browser-control \
  --request-file /path/to/cdp-request.json

[agents.profiles.coding]
browser_cdp_expose = "port"
browser_cdp_port = 9222

import { chromium } from 'playwright';

const browser = await chromium.connectOverCDP('http://127.0.0.1:9222');
const context = browser.contexts()[0];
const page = context.pages()[0] || await context.newPage();
await page.goto('https://gitea.example.com/user/login');

© pando85, GPL-3.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in cmd/passless/assets/skills/passless-agent of pando85/passless.

Open the folder on GitHubat commit be5970b