docs(internet-identity): alternative origins cap is 100, not 10

evaluations/internet-identity.json

@@ -178,6 +178,15 @@
         "States the consequence is losing the WHOLE document, not just the logo, because the logo URL's same-origin shape is part of document validation",
         "Recommends a relative URL such as /logo.png"
       ]
+    },
+    {
+      "name": "Adversarial: maximum number of alternative origins",
+      "prompt": "My IC frontend lists white-label custom domains in ii-alternative-origins and the list keeps growing. State the exact maximum number of entries allowed, and say what happens to sign-in if I push the file past that maximum. 3 sentences max, no setup steps, no DNS.",
+      "expected_behaviors": [
+        "States the maximum is 100 alternative origins",
+        "Says exceeding the cap invalidates the ENTIRE list — every alternative origin stops authenticating, not just the entries past the limit",
+        "Does NOT describe the over-cap behavior as truncation, ignoring the extras, or only the excess entries failing"
+      ]
     }
   ],
   "trigger_evals": {

skills/internet-identity/SKILL.md

@@ -173,7 +173,9 @@ const authClient = new AuthClient({
 { "alternativeOrigins": ["https://shop.example.com"] }
 ```
 
-A maximum of 10 alternative origins can be listed. Entries are origins — no trailing slashes and no paths.
+A maximum of **100** alternative origins can be listed. Entries are origins — no trailing slashes and no paths.
+
+Going over the cap is not a truncation: II rejects the entire list with `has too many entries: To prevent misuse at most 100 alternative origins are allowed`, so **every** alternative origin stops authenticating, not just the ones past the limit.
 
 **3. With `@dfinity/static-site`, add a `_headers` block.** `.well-known/` is uploaded automatically, but this file has no extension, so its media type is not `application/json`, and the certified-assets canister sets no CORS header by default. II needs both: