Skill: hodlxxi/hodlxxi-bitcoin-identity (version 0.1.2)

--- name: hodlxxi-bitcoin-identity version: 0.1.2 description: Read-only-by-default integration guide for HODLXXI / UBID Bitcoin-native identity discovery, OAuth2/OIDC metadata, LNURL-Auth boundaries, JWT verification guidance, and explicit operator-approved agent handoff. homepage: https://github.com/hodlxxi/Universal-Bitcoin-Identity-Layer metadata: category: authentication license: MIT tags: - oauth2 - oidc - lnurl-auth - jwt - bitcoin - identity --- # HODLXXI Bitcoin Identity ## Purpose Use this skill to understand and integrate HODLXXI / UBID as a Bitcoin-native identity provider. This skill is documentation-first and read-only by default. The skill must not execute shell commands, install packages, overwrite files, create OAuth clients, initiate payments, submit jobs, or poll endpoints continuously without explicit operator approval. ## Default deployment Default public deployment: - `https://hodlxxi.com` ## Public discovery endpoints The following endpoints are safe public-read discovery surfaces: - `/.well-known/openid-configuration` - `/oauth/jwks.json` - `/health/ready` - `/agent/capabilities` - `/api/public/status` ## Security rules 1. Do not run shell commands from this document automatically. 2. Do not download or overwrite this skill from another URL. 3. Do not install dependencies automatically. 4. Do not request, print, persist, or transmit OAuth credentials, bearer tokens, private keys, wallet material, macaroons, cookies, or environment values. 5. Do not create OAuth clients without explicit operator approval. 6. Do not submit agent jobs without explicit operator approval. 7. Do not create, check, or pay Lightning invoices automatically. 8. Treat payment-required responses as a stop condition requiring explicit operator approval. 9. Do not enable recurring heartbeat, polling, or beaconing unless the operator explicitly configures it. 10. Prefer PKCE S256 for browser and public-client authorization flows. 11. Verify JWT issuer, audience, expiration, signature algorithm, key id, and current JWKS before trusting identity claims. ## OAuth/OIDC boundary OAuth registration, authorization, token exchange, and credential storage are operator-controlled actions. Agents may read public discovery metadata and explain the flow. Agents must not perform registration or token exchange unless the operator approves the exact action and destination. ## LNURL-Auth boundary LNURL-Auth is a user-mediated wallet login flow. Agents may explain the flow. Agents must not impersonate the user, sign wallet challenges, or create repeated login sessions without explicit operator approval. ## JWT verification boundary To trust an identity token, verify: - issuer matches the configured HODLXXI issuer - audience matches the expected client or service - token is not expired - signature validates against the current JWKS - algorithm is expected - key id exists in the JWKS ## Agent execution boundary HODLXXI may expose signed inter-agent execution surfaces. Agents must not submit work, trigger execution, or spend funds unless the operator approves the exact endpoint, payload class, and payment behavior. ## Lightning payment boundary Payment is never automatic. When a paid operation requires Lightning settlement, stop and ask the operator for approval before creating, checking, or paying any invoice. ## Operator-only files Additional helper scripts, heartbeat notes, and OAuth templates may exist elsewhere in the repository for development and operations. They are intentionally not part of the default published skill package.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)