wendy-certificates — Claude Code skill: what it does, how to install
Guides certificate issuance, renewal, and revocation through pki-core across the Wendy platform. Helps configure operator credentials, service accounts, and offline USB device entitlements.
npx skills add wendylabsinc/claude-skills --skill wendy-certificates -a claude-codeWhat wendy-certificates does
This skill teaches coding agents how Wendy handles certificate lifecycles via pki-core. The engine acts as the single issuer, binding keys created on the client. It separates cloud sessions from offline hardware access. Cloud connections require identity-only credentials because servers check permissions in real time. Direct hardware operations over USB demand operator certificates loaded with explicit capability grants.
Cryptographic standards are strict. Private keys must stay on the client, configured as WebCrypto keys with extractable:false or stored inside hardware authenticators. Server-side key creation is prohibited for principals. Request signing relies on post-quantum ML-DSA-65 wrapped in JWS or COSE_Sign1 envelopes. Static personal access tokens do not exist in this design. Instead, CI pipelines exchange OIDC identity tokens for temporary credentials tied to SPIFFE identities.
Deployments must always support self-hosted operation without SaaS dependencies. Any workflow that breaks on standalone wendyos or wendy-agent instances fails the contract.
What it helps with
- separate identity-only certificates from entitlement grants
- configure ephemeral CI authentication without static tokens
- sign certificate requests using post-quantum ML-DSA-65
- issue SPIFFE service credentials for automated workloads
Example prompts for the agent
- Draft a certificate signing request for an operator needing direct USB access
- Set up short-lived CI credentials via OIDC federation without personal access tokens
- Verify that this certificate renewal flow works on a standalone self-hosted node
How to install wendy-certificates
1Skills CLI (Vercel)
npx skills add wendylabsinc/claude-skills --skill wendy-certificates -a claude-code2Manually: put the files in place
~/.claude/skills/wendy-certificates/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/wendy-certificates/
1Skills CLI (Vercel)
npx skills add wendylabsinc/claude-skills --skill wendy-certificates -a codex2Manually: put the files in place
.agents/skills/wendy-certificates/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add wendylabsinc/claude-skills --skill wendy-certificates -a cursor2Manually: put the files in place
.cursor/skills/wendy-certificates/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install wendylabsinc/claude-skills wendy-certificates2Manually: put the files in place
.github/skills/wendy-certificates/SKILL.md1Skills CLI (Vercel)
npx skills add wendylabsinc/claude-skills --skill wendy-certificates -a gemini-cli2Platform CLI
gemini skills install https://github.com/wendylabsinc/claude-skills --path wendy-certificatesManually: put the files in place
.devin/skills/wendy-certificates/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add wendylabsinc/claude-skills --skill wendy-certificates -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about wendy-certificates
How do I install wendy-certificates in Claude Code?
Run npx skills add wendylabsinc/claude-skills --skill wendy-certificates -a claude-code in your terminal. The configuration writes to ~/.claude/skills/wendy-certificates/SKILL.md.
What does the wendy-certificates skill do?
It provides operational guidelines for issuing, renewing, and revoking credentials through pki-core. The skill enforces key generation rules, signature algorithms, and SPIFFE identity formats.
What cryptographic constraints does this skill enforce?
Private keys must be generated client-side with extractable:false or on FIDO2 authenticators, while request proofs must use ML-DSA-65 signatures. Long-lived bearer tokens and server-side key generation are prohibited.
