Credentials, Skills, and Scripts

These three extension points affect agent execution but have different purposes and trust boundaries.

Agent credentials

Credentials connect Stib to an agent/provider account. Depending on the provider, Stib can support an OAuth profile, an API key, or a provider-native login. The credential screen reports discovered models, capabilities, quota/lock state, verification status, and refresh errors when available.

Credential scope can be server-wide, inherited through an organization, or overridden by a project. Restrict a credential to the smallest useful scope. The selected card/column/board can still choose among the credentials it is allowed to see.

Provider API keys and Stib API Keys are not interchangeable:

• a provider key lets an agent runtime call its model service;
• a Stib API key authorizes an external tool to call selected Stib project endpoints.

Secrets are encrypted with the server encryption key. Rotating or losing that key affects every stored provider and integration secret.

Verify before use

Use the verification and model-discovery actions offered by the credential form. A successful OAuth login does not guarantee the account has quota, model access, or every native capability. Fix an expired or locked credential before retrying cards that depend on it.

Skills

Skills are instructions/tools discoverable from server-wide and project locations. Project settings enable bundled skills and materialize them into the repository where required. Provider-native skill directories can also be discovered when compatible.

A Skill column must reference a valid discovered skill. Skill availability does not bypass the agent provider's own permissions.

Review skill source before enabling it: a skill can instruct an agent to execute commands, read files, or call external systems.

Project scripts

Scripts are explicit shell commands executed by the server in the project working directory. Configure name, command, and supported execution options in Project settings → Scripts.

Recommended rules:

• store complex scripts in the repository and call them by a short Stib command;
• make exit codes meaningful and output concise diagnostics;
• do not embed credentials in the command;
• add timeouts and idempotence for automation;
• test against the same server/container filesystem and toolchain used by agents.

Script runs have their own status and logs. Cancelling a run stops the process but cannot undo completed side effects.

Next: Pipeline and Automation and Server Configuration.