# wendy-certificates

Guides certificate issuance, renewal, and revocation through pki-core across the Wendy platform. Helps configure operator credentials, service accounts, and offline USB device entitlements.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · ★ 62
- Author: wendylabsinc
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/wendylabsinc/claude-skills/tree/HEAD/wendy-certificates/SKILL.md
- Updated: 2026-10-22
- HTML: https://affpapa.org/en/nevibecode/skills/wendy-certificates

## What it does

This skill teaches coding agents how Wendy handles certificate lifecycles via `pki-core`. The engine acts as the single issuer, binding keys created on the client. It separates cloud sessions from offline hardware access. Cloud connections require identity-only credentials because servers check permissions in real time. Direct hardware operations over USB demand operator certificates loaded with explicit capability grants.

Cryptographic standards are strict. Private keys must stay on the client, configured as WebCrypto keys with `extractable:false` or stored inside hardware authenticators. Server-side key creation is prohibited for principals. Request signing relies on post-quantum ML-DSA-65 wrapped in JWS or COSE_Sign1 envelopes. Static personal access tokens do not exist in this design. Instead, CI pipelines exchange OIDC identity tokens for temporary credentials tied to SPIFFE identities.

Deployments must always support self-hosted operation without SaaS dependencies. Any workflow that breaks on standalone `wendyos` or `wendy-agent` instances fails the contract.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add wendylabsinc/claude-skills --skill wendy-certificates -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/wendy-certificates/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/wendy-certificates/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add wendylabsinc/claude-skills --skill wendy-certificates -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/wendy-certificates/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add wendylabsinc/claude-skills --skill wendy-certificates -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/wendy-certificates/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install wendylabsinc/claude-skills wendy-certificates
```

2. **Manually: put the files in place**
- File: `.github/skills/wendy-certificates/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add wendylabsinc/claude-skills --skill wendy-certificates -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/wendylabsinc/claude-skills --path wendy-certificates
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/wendy-certificates/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add wendylabsinc/claude-skills --skill wendy-certificates -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/wendylabsinc/claude-skills/tree/HEAD/wendy-certificates/SKILL.md

## When to use it
- separate identity-only certificates from entitlement grants
- configure ephemeral CI authentication without static tokens
- sign certificate requests using post-quantum ML-DSA-65
- issue SPIFFE service credentials for automated workloads

## Example prompts
- Draft a certificate signing request for an operator needing direct USB access
- Set up short-lived CI credentials via OIDC federation without personal access tokens
- Verify that this certificate renewal flow works on a standalone self-hosted node

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [wendylabsinc/claude-skills](https://affpapa.org/en/nevibecode/by/wendylabsinc/claude-skills.md) — 25 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md