New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Request Access

by yc-software in yc-software/qm

Ask a person for access to one of their keychain credentials when a command needs it and this conversation has no grant yet.

MITAuto-check passed

Install Request Access

skills CLI
$ npx skills add yc-software/qm --skill request-access -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install yc-software/qm request-access --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/yc-software/qm.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills-seed/request-access .claude/skills/request-access && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
request-access
GitHub stars
15k
Token cost
~465 tokens
SKILL.md length
222 words
Files
1
Skills in repo
29
Repo updated
First seen
Licence
MIT

At a glance

Ask a person for access to one of their keychain credentials when a command needs it and this conversation has no grant yet.

  • SKILL.md covers Request, Where the card shows up and Then
  • Calls curl; needs AGENT_API_TOKEN

What it does

Request Access is an agent skill from yc-software/qm. Ask a person for access to one of their keychain credentials when a command needs it and this conversation has no grant yet. The platform posts an approval card where this conversation is happening; the owner clicks it, and the blocked command re-runs.

Its SKILL.md is about 470 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

The repository describes itself as: Multiplayer agent harness for work. The licence is MIT.

Example prompts

  • “/request-access”

Requirements

  • A credential in AGENT_API_TOKEN

What it can do on your machine

Read from SKILL.md and the folder at commit 23af31b. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • curl

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use curl, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names these keys or tokens, usually read from environment variables:

    • AGENT_API_TOKEN

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Request Access loads about 465 tokens when it runs. Until then it costs about 67 tokens; SKILL.md has 222 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~67
When it runs · the whole SKILL.md, loaded when a task matches
~465

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from yc-software/qm at commit 23af31b, republished under its MIT licence (© yc-software). 222 words, ~465 tokens.

Download SKILL.mdSave it as .claude/skills/request-access/SKILL.md (or your agent's skills folder).
name
request-access
description
Ask a person for access to one of their keychain credentials when a command needs it and this conversation has no grant yet. The platform posts an approval card where this conversation is happening; the owner clicks it, and the blocked command re-runs.

Request access to someone's credential

Use this when the keychain manifest lists a credential you need but shows no grant for this conversation. Your own credentials in your own personal conversation never need this.

Request

One call, from this session or any sub-agent. The approval belongs to the whole conversation, so every session in it sees the same grant.

sh
curl -fsS -X POST "$AGENT_API_URL/v1/keychain/asks" \
  -H "x-agent-capability: $AGENT_API_TOKEN" -H 'content-type: application/json' \
  -d '{"credential":"<credential id>","purpose":"<what the command will do>"}'
  • purpose is one plain sentence about the command, not the whole task.
  • Add "requestedMode":"once" only when a single command is all you need. The default lasts until revoked.
  • If a request for that credential is already pending, the same one comes back. Don't ask twice.

Where the card shows up

You don't choose. The card appears where this conversation is: the Slack thread or channel, inline in the web session (and in its parent when you are a sub-agent), or the scheduled job's destination. Only the credential's owner can click it; nothing said in chat is approval.

Then

  • Tell the person in one short line that you asked the owner for access. No request ids, no request text, no "paused".
  • Stop. Don't retry, poll, or work around the missing credential.
  • When the owner approves, this conversation re-runs the blocked command on its own. Continue with one short line.
  • If they deny or it expires, say so in one line and offer another way.

© yc-software, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills-seed/request-access of yc-software/qm.

Open the folder on GitHubat commit 23af31b

Compare with similar skills

Request Access next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Request Access compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Request Access this skillyc-software/qm15k—~465Automated safety check: PassMIT
Credentialsgoogle-deepmind/science-skills3.2k—~1kAutomated safety check: NotesApache-2.0
Credentialsalsk1992/CloddsBot2.9k—~1.4kAutomated safety check: PassMIT
Detecting Compromised Cloud Credentialsmukul975/Anthropic-Cybersecurity-Skills34k—~3.9kAutomated safety check: PassApache-2.0
Abusing Dpapi For Credential Accessmukul975/Anthropic-Cybersecurity-Skills34k—~2.7kAutomated safety check: WarnApache-2.0
Detecting T1003 Credential Dumping With Edrmukul975/Anthropic-Cybersecurity-Skills34k—~1.8kAutomated safety check: PassApache-2.0

Similar skills

  • Credentials

    google-deepmind/science-skills

    Instructions for handling API keys and credentials safely, verifying their presence, and prompting the user to add them if missing using a safe protocol.

    3.2k GitHub stars~1k tokensUpdated 22 days ago
    Research & ScienceAuto-check: notes

  • Credentials

    alsk1992/CloddsBot

    Secure credential management for trading platforms. An agent skill from alsk1992/CloddsBot.

    2.9k GitHub stars~1.4k tokensUpdated 5 days ago
    Business, Finance & HRAuto-check passed

  • Detecting Compromised Cloud Credentials

    mukul975/Anthropic-Cybersecurity-Skills

    Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible-travel patterns, and credential-stuffing indicators using GuardDuty, Microsoft…

    34k GitHub stars~3.9k tokensUpdated 1 mo ago
    DevOps & CloudAuto-check passed

  • Abusing Dpapi For Credential Access

    mukul975/Anthropic-Cybersecurity-Skills

    Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or…

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    SecurityAuto-check: warnings

  • Detecting T1003 Credential Dumping With Edr

    mukul975/Anthropic-Cybersecurity-Skills

    Detect OS credential dumping (MITRE T1003) targeting LSASS memory, the SAM database, NTDS.dit, and cached credentials by correlating EDR telemetry, Sysmon process-access events, and Windows security…

    34k GitHub stars~1.8k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Build A Personal Skill From History

    THU-MAIC/OpenMAIC

    Derives a reusable personal skill for course-making from a representative sample of the user's own past classrooms and chat history, confirmed with them before saving.

    40k GitHub stars~678 tokensUpdated today
    Agent WorkflowsAuto-check passed

More from yc-software/qm

All 29 skills in this repo

  • Admin

    yc-software/qm

    Act for an org admin — the admin API (scope directory, per-scope config & SOUL, any scope's memory, transcripts & captured prompts, files, user roster & external users, audit/errors/metrics/egress)…

    15k GitHub stars~3.1k tokensUpdated yesterday
    Auto-check passed

  • Browse

    yc-software/qm

    Drive a real stealth browser from your shell — act on websites (order food, file an expense, pull data behind a login), with per-person persistent sign-ins via the provider's managed auth (Kernel…

    15k GitHub stars~4k tokensUpdated yesterday
    Auto-check passed

  • Composio

    yc-software/qm

    Show the app connection picker or setup widget when users ask to connect apps, reopen setup, or need an app that isn't connected yet.

    15k GitHub stars~1.6k tokensUpdated yesterday
    Auto-check passed

  • Dev Instance

    yc-software/qm

    Run the current worktree as a production-shaped local dev instance with web, Slack, or both, on a real LLM + Postgres.

    15k GitHub stars~3.7k tokensUpdated yesterday
    Auto-check: notes

  • GitHub GitLab

    yc-software/qm

    Work with GitHub and GitLab repositories through resident gh/glab/git auth on the agent computer.

    15k GitHub stars~1.6k tokensUpdated yesterday
    Auto-check passed

  • Google Workspace

    yc-software/qm

    Read and act on the user's Gmail, Google Calendar, and Google Tasks through per-user OAuth.

    15k GitHub stars~1.8k tokensUpdated yesterday
    Auto-check passed

Questions about Request Access

What does Request Access do?

Ask a person for access to one of their keychain credentials when a command needs it and this conversation has no grant yet. Request Access is an agent skill from yc-software/qm. Ask a person for access to one of their keychain credentials when a command needs it and this conversation has no grant yet.

How do I install Request Access in Claude Code?

Run `npx skills add yc-software/qm --skill request-access -a claude-code`. Or copy the skill folder (skills-seed/request-access in yc-software/qm) into .claude/skills/request-access in your project. Claude Code loads it when a task matches its description.

How do I install Request Access in Codex?

Run `npx skills add yc-software/qm --skill request-access -a codex`. Or copy the skill folder (skills-seed/request-access in yc-software/qm) into .agents/skills/request-access in your project. Codex loads it when a task matches its description.

Can I use Request Access in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add yc-software/qm --skill request-access -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/request-access, .gemini/skills/request-access, .github/skills/request-access and .opencode/skills/request-access in your project.

What does Request Access need to run?

Going by SKILL.md and its folder, Request Access needs the command-line tools its instructions call (curl) and credentials named AGENT_API_TOKEN. Our summary lists: A credential in AGENT_API_TOKEN.

Does Request Access access the network?

SKILL.md contains no URLs. Its commands use curl, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Request Access safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Request Access use?

Request Access is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Request Access use?

About 465 tokens (SKILL.md is roughly 1.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Request Access?

Skills that share tags, products or a category with Request Access: Credentials (google-deepmind/science-skills, 3.2k stars), Credentials (alsk1992/CloddsBot, 2.9k stars), Detecting Compromised Cloud Credentials (mukul975/Anthropic-Cybersecurity-Skills, 34k stars) and Abusing Dpapi For Credential Access (mukul975/Anthropic-Cybersecurity-Skills, 34k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Request Access?

yc-software (a GitHub organization) maintains it in yc-software/qm, which has 15,357 GitHub stars. The repository holds 29 skills in this directory. The repository was last updated on October 6, 2026.

Source: yc-software/qm on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.