permissions-broker

Proxy API requests with user approval via Telegram for Google, GitHub, iCloud, and Spotify.

2|Updated Feb 9, 2026

Search Tags:#security #api #oauth #permissions #proxy #third-party access

Ready to run

npx skills add https://github.com/stephancill/permissions-broker --skill permissions-broker

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: permissions-broker
Source: https://github.com/stephancill/permissions-broker/tree/main/skills/permissions-broker
Command: npx skills add https://github.com/stephancill/permissions-broker --skill permissions-broker

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides a secure and user-approved mechanism for accessing external data and performing actions on behalf of the user when direct local credentials are not available or appropriate.

Core Features & Use Cases

Gated API Access: Acts as a proxy for API requests, requiring explicit user approval in Telegram for each operation.
Provider Integration: Supports multiple providers like Google (Drive/Docs/Sheets), GitHub, iCloud (CalDAV), and Spotify.
Use Case: An agent needs to read a specific file from a user's Google Drive. Instead of directly accessing the Drive API (which the agent might not have permission for), it uses the Permissions Broker. The user receives a prompt in Telegram to approve this specific file access request before the agent can proceed.

Quick Start

Use the permissions-broker skill to list files in your Google Drive by creating a request for the Google Drive API.

Frequently Asked Questions about permissions-broker

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I securely proxy third-party API requests for an AI agent?▼

Yes, you can manage OAuth tokens for services like Google and Spotify by connecting your user-issued API keys to a broker, which handles token management and gates access behind explicit Telegram approvals.

How do I require user consent before an agent reads my Google Drive files?▼

To set up gated access, issue your own API keys to the broker and connect your desired providers. The broker then acts as a proxy, prompting you in Telegram to explicitly approve each operation before executing it.

Does this proxy approach work with iCloud CalDAV and Spotify APIs?▼

You must provide your own user-issued API keys for the services you want to connect. The broker uses these keys to handle OAuth token management and facilitate access to supported providers like GitHub and Spotify.

What are the limitations of using a permissions broker for agent integrations?▼

If direct local credentials are available and appropriate for your environment, you do not need this proxy approach, which is specifically designed to manage secure access when local credentials are unavailable.