Skip to main content
affpapa.org
RU EN
skill CX Codex

wendy-device-enrollment — Claude Code skill: enrolling WendyOS devices

Walks your agent through first-touch enrollment of WendyOS devices in pki-core and the certificate lifecycle that follows.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add wendylabsinc/claude-skills --skill wendy-device-enrollment -a claude-code
Open on GitHub

What wendy-device-enrollment does

This skill is a reference the agent consults when a WendyOS device has to join pki-core. Three files ship with it: device tiers, first touch, and trusted time. Two first-boot paths are covered. With a network, the operator asks for a token while installing the OS, the cloud forwards the signed request to pki-core, and a single-use token bound to that device and tenant comes back. Airgapped, the machine links to the operator's computer, generates a CSR, and the operator carries a signed request to the cloud for a grant.

The keypair is created on the device itself and the private half stays there. A platform root travels inside the OS image, so the delivered chain gets checked against what was already flashed instead of being trusted on sight. Renewal runs unattended over ACME/EST, yet it only works while the current certificate is valid; an expired one needs a standing proof, such as re-attestation or an operator grant. When trusted time cannot be established, the device holds its state rather than guessing.

Any interop change must leave the self-hosted path intact, and the skill points to wendy-self-hosted for that. It distills AAA Contract v0.21; where the contract and the skill disagree, the contract is the one to follow. Have the hardware on your desk and pki-core reachable before you start.

What it helps with

  • enroll a WendyOS device online at first boot
  • run enrollment in an airgapped network via CSR
  • work out device tiers and TPM, OP-TEE or eFuse attestation
  • recover a device whose certificate has expired
  • keep renewals automatic over ACME/EST

Example prompts for the agent

  • Explain how to enroll a WendyOS device with pki-core over the network
  • The device has no internet — how do I get the CSR and the operator grant?
  • The cert expired; walk me through re-enrollment

How to install wendy-device-enrollment

1Skills CLI (Vercel)

npx skills add wendylabsinc/claude-skills --skill wendy-device-enrollment -a claude-code

2Manually: put the files in place

~/.claude/skills/wendy-device-enrollment/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/wendy-device-enrollment/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about wendy-device-enrollment

How do I install wendy-device-enrollment in Claude Code?

Run npx skills add wendylabsinc/claude-skills --skill wendy-device-enrollment -a claude-code. The skill lands at ~/.claude/skills/wendy-device-enrollment/SKILL.md.

What does wendy-device-enrollment do?

It gives the agent guidance on bringing WendyOS devices into pki-core: picking the online or airgapped flow, handling tokens, renewals, and recovery after a certificate expires.

Does it depend on the SaaS stack?

No. The wendy stack has to run without SaaS, and the skill tells you to consult wendy-self-hosted before touching interop code. A SaaS-only feature counts as unfinished.

Similar skills

All skills for Security →
git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set7

wendy-self-hosted A rule for agents touching Wendy interop code: the wendyos and wendy-agent stack has to run without the SaaS side. Useful for on-prem and airgapped setups. CX Codex +1 ★ 62repo stars wendy-iterating Runs a find-fix-ship loop: each change gets its own worktree, a subagent carries it to green CI, and the loop stops itself when nothing is left. CX Codex +1 ★ 62repo stars wendy-cloud-iterate Runs the Wendy Cloud dev stack end to end: brings up Docker and the Swift broker, runs integration tests, reads the failures and edits code. CX Codex +1 ★ 62repo stars swift-library-design Guides public API design for Swift libraries and frameworks: protocols, result builders, inlining, noncopyable types. CX Codex +1 ★ 62repo stars postgres-nio A skill that gives the agent a working reference for talking to PostgreSQL from Swift with postgres-nio: connections, pooling, prepared statements and COPY FROM. CX Codex +1 ★ 62repo stars github-actions A skill that steers the agent through GitHub Actions authoring: vendor actions over shell scripts, verified versions, minimal job permissions. CX Codex +1 ★ 62repo stars

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor