wendy-aaa-interop — Claude Code skill for the AAA contract
This skill explains how Wendy services divide identity, authorization, and credential issuance. Use it when changing integrations between the SaaS and self-hosted stacks.
npx skills add wendylabsinc/claude-skills --skill wendy-aaa-interop -a claude-codeWhat wendy-aaa-interop does
The skill maps responsibilities across wendy-auth, Wendy Cloud, pki-core, and wendy-proxy: which service identifies a principal, grants permissions, issues certificates, or enforces limits. It also covers two credential forms, signed artifacts that carry authority, and how correlation_id travels through service calls and audit records.
It draws a clear limit around the security guarantees. A compromised cloud service can raise the permissions of a legitimate principal, but only within the platform cap. That distinction matters when describing the threat model. Every interop change must also preserve the ability to run the Wendy stack without SaaS, or add that path where it is missing.
What it helps with
- assign authentication, authorization, and certificate issuance to the right services
- check which authority each credential form carries
- trace signed requests as they pass between services
- keep
correlation_idconsistent across calls and audit records - preserve a self-hosted path during interop changes
Example prompts for the agent
- Explain which Wendy services handle authentication, authorization, and certificate issuance.
- Check which credentials are used for direct operator access to a device.
- Review this interop change and show how it can run without SaaS.
How to install wendy-aaa-interop
1Skills CLI (Vercel)
npx skills add wendylabsinc/claude-skills --skill wendy-aaa-interop -a claude-code2Manually: put the files in place
~/.claude/skills/wendy-aaa-interop/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/wendy-aaa-interop/
1Skills CLI (Vercel)
npx skills add wendylabsinc/claude-skills --skill wendy-aaa-interop -a codex2Manually: put the files in place
.agents/skills/wendy-aaa-interop/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add wendylabsinc/claude-skills --skill wendy-aaa-interop -a cursor2Manually: put the files in place
.cursor/skills/wendy-aaa-interop/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install wendylabsinc/claude-skills wendy-aaa-interop2Manually: put the files in place
.github/skills/wendy-aaa-interop/SKILL.md1Skills CLI (Vercel)
npx skills add wendylabsinc/claude-skills --skill wendy-aaa-interop -a gemini-cli2Platform CLI
gemini skills install https://github.com/wendylabsinc/claude-skills --path wendy-aaa-interopManually: put the files in place
.devin/skills/wendy-aaa-interop/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add wendylabsinc/claude-skills --skill wendy-aaa-interop -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about wendy-aaa-interop
How do I install wendy-aaa-interop in Claude Code?
Run npx skills add wendylabsinc/claude-skills --skill wendy-aaa-interop -a claude-code. The skill file is at ~/.claude/skills/wendy-aaa-interop/SKILL.md.
What does wendy-aaa-interop do?
It explains the Wendy services’ authority boundaries, credential forms, and rules for carrying trust between components.
Can a compromised Wendy Cloud grant a principal more authority?
It can raise the permissions of a legitimate principal, but only up to the platform cap. Cloud cannot obtain a credential as that principal without the principal’s key or signature.
