identity

What This Skill Does

The identity skill for OpenClaw is a robust security and authorization management interface designed for the Volcengine ecosystem. It acts as the central hub for managing UserPool OIDC login flows, TIP (Workload Access Token) lifecycle management, and credential hosting. By bridging the gap between the agent and cloud infrastructure, this skill ensures that all identity-related operations—such as authenticating users, fetching OAuth2 credentials, and managing environment variable bindings—are handled securely and transparently. Furthermore, the skill integrates a comprehensive permission management system (AuthZ), allowing users to monitor and approve potentially high-risk tool calls through chat-based interactions.

Installation

To integrate this skill into your OpenClaw environment, execute the following command in your terminal: clawhub install openclaw/skills/skills/loveyana/volcengine-agent-identity

Use Cases

• Unified Authentication: Streamlining user logins across various Volcengine services without manual token management.
• Secure Credential Management: Safely hosting API keys and OAuth2 tokens while mapping them to specific environment variables for tool usage.
• Risk Control and Auditing: Implementing a granular 'Human-in-the-loop' verification process for sensitive agent actions. If an agent attempts an action flagged as high-risk, the identity plugin pauses the process, requiring the user to explicitly approve via an /identity approve <id> command.
• Session Lifecycle Monitoring: Regularly checking session health, TIP expiration times, and verifying current account status to ensure uninterrupted workflow execution.

Example Prompts

1. "I need to access my cloud resources. Can you help me log in via OIDC and set up the necessary credentials?"
2. "Show me the status of my current session and list all API credentials that I have currently bound to environment variables."
3. "I received a notification about a risky tool call. Can you list the pending approvals so I can authorize the correct one?"

Tips & Limitations

• Security First: Never share your TIP tokens or sensitive keys in conversation history. The agent automatically redacts sensitive data in output.
• Human Verification: Do not attempt to override the risk-approval system. The system is designed to force explicit user confirmation for high-risk operations; the agent itself is strictly forbidden from self-approving these tasks. Use the /identity approve command exclusively for manual verification.
• Documentation: For deep technical details regarding specific OIDC flows or Volcengine IAM policies, refer to the official Volcengine documentation linked within the plugin configuration.