Lix Agents

Obtain temporary Lix API tokens via CLI with human email approval. Use when you need authenticated access to the Lix API, need to enrich data via Lix, or nee...

Security Scan

The skill's instructions match its stated purpose (obtaining temporary Lix API tokens via a CLI); it asks the agent to install and run a third‑party CLI and to handle short‑lived tokens, which is coherent but carries typical supply‑chain and token‑handling risks you should verify before use.

Purpose & Capability

The name/description (obtain temporary Lix API tokens) align with the instructions: the SKILL.md explicitly directs the agent to check for, install, and use the 'lix-agents' CLI and to request tokens. Nothing requested (no extra credentials or unrelated services) contradicts the stated purpose.

Instruction Scope

Instructions direct the agent to run local shell commands (which, in a deployed agent environment, means invoking system commands), to install software, and to capture tokens printed to stdout. The doc explicitly requires user confirmation before each step, which reduces risk, but there is potential for token leakage if the agent posts the token into a conversation or logs. The instructions stay within the claimed scope but involve sensitive local actions (installing binaries, handling auth tokens).

Install Mechanism

There is no automated install spec (skill is instruction-only), which is lower risk. The SKILL.md suggests installing via 'brew tap lix-it/lix-agents && brew install lix-agents', 'go install', or downloading GitHub Releases. Those are plausible methods but tapping an external brew repo or downloading arbitrary releases is a supply‑chain risk and should be verified (review the repo/release artifacts).

Credentials

The skill declares no required environment variables or credentials and does not ask for unrelated secrets. It only handles temporary API tokens for Lix, which is proportional to its purpose.

Persistence & Privilege

always is false, the skill does not request persistent privileges or modify other skills/config. It does instruct saving a local session/token (normal for CLI auth), but it does not demand elevated or system‑wide configuration access.

Assessment

This skill is coherent with its purpose, but follow these precautions before installing or running it: 1) Verify the 'lix-agents' source (review the GitHub repo/releases and maintainers) before tapping a brew repo or downloading binaries. 2) Prefer installing software yourself rather than allowing an automated agent to run install commands. 3) Never paste API tokens into chat — treat the token as sensitive and store it only in your environment or a secure credential store. 4) Confirm the agent asks for permission before each command (SKILL.md instructs this, enforce it). 5) If you need stronger assurance, inspect the CLI code (go module or release assets) to ensure it does what it claims and does not exfiltrate tokens.

Use lix-agents to get temporary API tokens for the Lix API. Tokens require human approval via email, so agents never hold unsupervised credentials.

Always tell the user what you're doing and why before running each command. Don't silently run commands — explain the purpose of each step so the user can follow along.

When to use this

• You need to call any https://api.lix-it.com endpoint that requires authentication
• You need to enrich LinkedIn profiles, companies, or other data via Lix
• You don't already have a valid Lix API token in your environment

Step-by-step workflow

Follow these steps in order. Before each step, explain to the user why you're running the command.

Step 1: Check if lix-agents is installed

Tell the user: "First, I'll check if the lix-agents CLI is installed on your machine."

which lix-agents

If the command is not found, tell the user you need to install it and why — it's a CLI that manages Lix API authentication for AI agents. Then install it:

brew tap lix-it/lix-agents && brew install lix-agents

If brew is unavailable, suggest go install github.com/lix-it/lix-agents@latest or downloading from GitHub Releases.

Step 2: Check if the user is already logged in

Tell the user: "Now I'll check if you already have a Lix session. This avoids asking you to log in again if you've done it before."

lix-agents auth status

• If already logged in, skip to Step 4.
• If not logged in, continue to Step 3.

Step 3: Log in (only if needed)

Tell the user: "You're not logged in yet. I'll start the login flow — this will give you a URL to open in your browser. You only need to do this once; your session will be saved locally."

lix-agents auth login

Share the URL with the user and wait for them to confirm they've signed in.

Step 4: Request a temporary API token

Tell the user: "Now I'll request a temporary API token. For security, Lix will send you an approval email — please check your inbox and approve the request. I'll wait for the approval before continuing."

lix-agents auth token

The command blocks until the user approves via email. Once approved, it prints the token to stdout. Save this token for use in subsequent API calls.

Step 5: Use the token

Set the token in the Authorization header for API requests:

Authorization: Bearer <token>

All requests go to https://api.lix-it.com. See the Lix API docs for available endpoints, request formats, and response formats.

Reference

Run lix-agents --help for the full command reference.