You can consider these agents criminals, or treat them like babies. Both can do harm for a while, but one offers a future.
Don't give it access to your ssh keys!
Yes, it should have its own dedicated key instead of sharing one of your own.
`ssh localhost` doesn't work for me. maybe because I have enabled only key-based ssh and my user key is not in authorized_keys? am I missing something?
You are right in that it would still need to authenticate.