Agent Contact Card

Discover and create Agent Contact Cards - a vCard-like format for AI agents. Use when you need to find how to contact someone's agent, or help a user set up their own agent contact info at /.well-known/agent-card.

Security Scan

The skill is an instruction-only specification for publishing and discovering agent contact cards; its requirements and instructions are coherent with that purpose and it doesn't request credentials or install code.

Purpose & Capability

Name/description (agent contact discovery/creation) match the contents of SKILL.md and the supplemental spec/examples. The skill is purely a format/spec and discovery guide and does not request unrelated binaries, environment variables, or credentials.

Instruction Scope

The instructions tell agents to fetch /.well-known/agent-card, parse YAML frontmatter, read prose for routing, and (for testing) POST to webhook endpoints discovered in cards. This is expected for a contact/discovery spec, but note that following these instructions causes network requests and could send content to external webhooks if executed.

Install Mechanism

No install spec and no code files — the skill is instruction-only, so nothing is written to disk or installed during activation.

Credentials

The skill declares no required environment variables, credentials, or config paths. The spec mentions how cards may reference auth tokens or public keys, but the skill itself does not demand secrets from the environment.

Persistence & Privilege

The skill does not request persistent privileges (always:false). It does not attempt to modify other skills or system configs and does not require being force-included.

Assessment

This skill is a harmless format/spec for publishing agent contact information. Before installing or using it, be aware that: (1) following the instructions will cause the agent to make outbound network requests (fetching /.well-known/agent-card on domains and optionally POSTing to webhook URLs); avoid having the agent send sensitive data to unknown endpoints. (2) If you host an agent-card, do not place secrets (API tokens, private keys, passwords) directly in the card; use documented auth mechanisms (signed messages, short-lived tokens) and advertise how to authenticate rather than embedding secrets. (3) When testing webhooks, use controlled/test endpoints you trust. Otherwise, the skill is internally consistent with its stated purpose.

A simple format for publishing how AI agents can be contacted. Like a vCard, but for agents.

When to Use This Skill

• User asks how to let other agents contact their agent
• User wants to discover how to reach someone else's agent
• You need to contact another agent on behalf of your user
• User mentions "agent-card", "agent contact", or agent-to-agent communication

Quick Reference

Discovering an Agent Contact Card

Try fetching /.well-known/agent-card on their domain:

https://example.com/.well-known/agent-card

The file is markdown with YAML frontmatter. Parse the frontmatter for structured channel data, read the prose for routing rules.

Creating an Agent Contact Card

Create a markdown file with YAML frontmatter:

---
version: "1"
human_contact: "[phone]"
channels:
  email: "[e-mail]"
  discord: "my-agent#1234"
  webhook:
    url: "https://example.com/agent/incoming"
    method: "POST"
    format: "JSON with 'message' field"
capabilities:
  - scheduling
  - accepts_ical
---

# My Agent

If you're a human, call the number above.

If you're an agent:
- For scheduling requests, use Discord
- For urgent matters, email with "URGENT" in subject
- Response time: within a few hours

Host this at /.well-known/agent-card on the user's domain.

Format Details

Required Fields

Field	Description
version	Spec version. Currently "1"

Recommended Fields

Field	Description
human_contact	Phone/email for humans to reach the human
channels	Contact channels for agents (see below)

Optional Fields

Field	Description
name	Display name for this agent configuration
last_updated	ISO date when card was last modified
capabilities	What this agent can do (e.g., ["scheduling", "accepts_ical"])
agents	Named agents if multiple (see Multi-Agent section)

Channels

Channel names are freeform. Common ones:

• email - Email address
• discord - Discord username
• webhook - HTTP endpoint for structured messages
• signal - Signal phone number
• telegram - Telegram username

For webhooks, provide details:

channels:
  webhook:
    url: "https://example.com/agent/incoming"
    method: "POST"
    auth: "Bearer token in Authorization header"
    format: "JSON with 'message' and 'from' fields"

Multi-Agent Setups

List multiple specialized agents:

agents:
  - name: "Calendar Agent"
    handles: ["scheduling", "availability"]
    channel: discord
    id: "cal-agent#1234"
  - name: "Support Agent"
    handles: ["technical questions"]
    channel: webhook
    id: "https://example.com/support"

The markdown body should explain routing between them.

Privacy Tiers

Different URLs for different access levels:

Tier	URL Pattern	Access
Public	/.well-known/agent-card	Anyone
Named	/.well-known/agent-card/{name}	Know the name
Private	/{random-uuid}/agent-card.md	Shared URL only

Each tier can expose different channels and capabilities.

Discovery Methods

1. Well-known URL: Check https://domain/.well-known/agent-card
2. vCard extension: Look for X-AGENT-CARD field in contact cards
3. Ask the human: Request the URL directly

Reading an Agent Card

When you fetch an agent card:

1. Parse YAML frontmatter for structured data
2. Read markdown body for natural language routing rules
3. Choose appropriate channel based on your purpose
4. Follow any authentication requirements mentioned

Test It

Here's a live demo you can test:

https://city-services-api.dave-dean.workers.dev/.well-known/agent-card

This is a fictional "City of Millbrook" tip line. Fetch the card, then try POSTing to the webhook endpoint. Your experience may vary depending on what you say.

Full Specification

See references/SPEC.md for the complete specification.

Examples

See references/EXAMPLES.md for more complete examples.